EUVD-2026-21873
GHSA-5qqm-hxgj-wv38
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Integer overflow in Samsung Open Source Escargot causes undefined behavior and potential denial of service on local systems. The vulnerability affects the Escargot JavaScript engine (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and related versions) and requires local access with low complexity to trigger. With CVSS 5.1 and EPSS not specified, the risk is moderate; no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
Escargot is a lightweight JavaScript engine developed by Samsung for embedded systems and IoT devices. The vulnerability is rooted in CWE-190 (Integer Overflow or Wraparound), a classic memory safety issue where arithmetic operations on integer values exceed the valid range, causing wraparound or underflow. This can corrupt memory buffers or heap structures, leading to undefined behavior. The affected component processes JavaScript execution or parsing, and the integer overflow likely occurs in memory allocation, size calculations, or array indexing logic. The vulnerability is tracked in the Samsung Escargot repository and requires local system access (AV:L) and non-trivial conditions to exploit (AC:H).
RemediationAI
Apply the fix via Samsung's Escargot GitHub repository pull request #1554 (https://github.com/Samsung/escargot/pull/1554), which addresses the integer overflow condition. Users should pull the latest code from the main branch or await a tagged release incorporating the fix. If immediate patching is not possible, restrict execution of untrusted JavaScript code in Escargot-based applications and monitor for crashes or unexpected behavior. Organizations using Escargot in production systems (smart TVs, IoT devices) should prioritize updates through their device manufacturer's firmware update process.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today