EUVD-2026-21873
GHSA-5qqm-hxgj-wv38
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Integer overflow in Samsung Open Source Escargot causes undefined behavior and potential denial of service on local systems. The vulnerability affects the Escargot JavaScript engine (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and related versions) and requires local access with low complexity to trigger. With CVSS 5.1 and EPSS not specified, the risk is moderate; no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
Escargot is a lightweight JavaScript engine developed by Samsung for embedded systems and IoT devices. The vulnerability is rooted in CWE-190 (Integer Overflow or Wraparound), a classic memory safety issue where arithmetic operations on integer values exceed the valid range, causing wraparound or underflow. This can corrupt memory buffers or heap structures, leading to undefined behavior. The affected component processes JavaScript execution or parsing, and the integer overflow likely occurs in memory allocation, size calculations, or array indexing logic. The vulnerability is tracked in the Samsung Escargot repository and requires local system access (AV:L) and non-trivial conditions to exploit (AC:H).
RemediationAI
Apply the fix via Samsung's Escargot GitHub repository pull request #1554 (https://github.com/Samsung/escargot/pull/1554), which addresses the integer overflow condition. Users should pull the latest code from the main branch or await a tagged release incorporating the fix. If immediate patching is not possible, restrict execution of untrusted JavaScript code in Escargot-based applications and monitor for crashes or unexpected behavior. Organizations using Escargot in production systems (smart TVs, IoT devices) should prioritize updates through their device manufacturer's firmware update process.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today