EUVD-2026-30839
GHSA-8r93-f22g-x9vj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized data payloads, resulting in a high-severity availability impact. The vulnerability is confirmed at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung TV and appliance platforms. An attacker who can cause a local user to open or execute a crafted JavaScript payload can trigger a stack overflow, denying service to the affected application or device; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Escargot (cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is Samsung's lightweight JavaScript engine designed for embedded and smart TV environments. CWE-674 (Uncontrolled Recursion) describes a class of defects where recursive function calls lack adequate depth bounds or termination guards, allowing crafted input to exhaust call-stack space and cause a segmentation fault or hard crash. The PR #1565 diff reveals a broad set of related correctness fixes bundled in the same patch: an integer underflow clamp in TypedArray.copyWithin (where buffer resize during argument coercion could produce a negative count subsequently cast to size_t), a null-safety guard in EvaluatorResult error handling for nested eval/finally allocation edge cases, an OOM abort handler in Heap.cpp, DataView coercion ordering fixes, FinalizationRegistry re-entry prevention, and array fast-mode handling for spread operations. The serialization recursion issue driving this CVE likely arises during parsing or structured-clone-style serialization of deeply nested JavaScript object graphs, where no recursion-depth limit is enforced before the native call stack is exhausted.
RemediationAI
Apply the upstream fix from GitHub Pull Request #1565 (https://github.com/Samsung/escargot/pull/1565), which addresses the uncontrolled recursion alongside several related correctness bugs in TypedArray, DataView, FinalizationRegistry, and array spread operations. Upstream fix is available as a PR/commit; a released tagged version with the patch is not independently confirmed from available data - downstream integrators should track the Escargot repository for a formal release incorporating these changes. As a compensating control where patching is not immediately possible, restrict the execution of untrusted or third-party JavaScript content within Escargot-based runtimes by disabling or sandboxing external widget or web-app loading features on affected Samsung devices. Note that disabling content loading may impact device functionality such as smart TV app stores or embedded browsers. Samsung device owners should monitor Samsung's security advisories for firmware updates addressing this engine version.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.0.0
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.0.0.
Out-of-bounds read and reachable assertion vulnerabilities in Samsung's open-source Escargot JavaScript engine allow a l
Heap-based buffer overflow in Samsung's open-source Escargot JavaScript engine corrupts heap memory when processing mali
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today