EUVD-2026-21826
GHSA-rwxh-99xg-w46m
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
5DescriptionCVE.org
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine exposes sensitive memory content to remote attackers through user interaction. The vulnerability affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and allows information disclosure with partial availability impact. CVSS 5.9 (medium) reflects the requirement for user interaction and high complexity attack prerequisites, though the memory exposure potential warrants monitoring for patches.
Technical ContextAI
Escargot is Samsung's lightweight JavaScript engine designed for embedded and IoT devices. The vulnerability is an out-of-bounds read (CWE-125), a memory safety flaw where the engine attempts to access array or buffer memory beyond allocated boundaries. This typically occurs in parser, lexer, or expression evaluation logic where bounds checking is insufficient. The memory read does not require elevated privileges (PR:N in CVSS vector) but depends on user interaction (UI:R) to trigger malicious JavaScript or HTML content. Remote attackers exploit this by crafting JavaScript code or embedding it in web content that causes the engine to read past buffer limits, leaking adjacent memory containing potentially sensitive data.
RemediationAI
Patch availability is indicated via GitHub PR #1554 (https://github.com/Samsung/escargot/pull/1554), which addresses the out-of-bounds read. Organizations should update Escargot to the patched commit (post-97e8115ab1110bc502b4b5e4a0c689a71520d335). Users of Samsung devices embedding Escargot should monitor Samsung's security advisories and apply firmware updates when released. No active workaround mitigates the memory read itself, but restricting untrusted JavaScript execution or applying network-level content filtering reduces exposure in the interim.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today