What is the CVSS score of CVE-2026-47309?

CVE-2026-47309 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Samsung Escargot CVE-2026-47309

EUVD-2026-30839 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-05-19 samsung.tv_appliance

GHSA-8r93-f22g-x9vj

Information Disclosure Samsung

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 06:47 vuln.today

Analysis Generated

May 19, 2026 - 06:47 vuln.today

DescriptionCVE.org

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

AnalysisAI

Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized data payloads, resulting in a high-severity availability impact. The vulnerability is confirmed at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung TV and appliance platforms. An attacker who can cause a local user to open or execute a crafted JavaScript payload can trigger a stack overflow, denying service to the affected application or device; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Escargot (cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is Samsung's lightweight JavaScript engine designed for embedded and smart TV environments. CWE-674 (Uncontrolled Recursion) describes a class of defects where recursive function calls lack adequate depth bounds or termination guards, allowing crafted input to exhaust call-stack space and cause a segmentation fault or hard crash. The PR #1565 diff reveals a broad set of related correctness fixes bundled in the same patch: an integer underflow clamp in TypedArray.copyWithin (where buffer resize during argument coercion could produce a negative count subsequently cast to size_t), a null-safety guard in EvaluatorResult error handling for nested eval/finally allocation edge cases, an OOM abort handler in Heap.cpp, DataView coercion ordering fixes, FinalizationRegistry re-entry prevention, and array fast-mode handling for spread operations. The serialization recursion issue driving this CVE likely arises during parsing or structured-clone-style serialization of deeply nested JavaScript object graphs, where no recursion-depth limit is enforced before the native call stack is exhausted.

RemediationAI

Apply the upstream fix from GitHub Pull Request #1565 (https://github.com/Samsung/escargot/pull/1565), which addresses the uncontrolled recursion alongside several related correctness bugs in TypedArray, DataView, FinalizationRegistry, and array spread operations. Upstream fix is available as a PR/commit; a released tagged version with the patch is not independently confirmed from available data - downstream integrators should track the Escargot repository for a formal release incorporating these changes. As a compensating control where patching is not immediately possible, restrict the execution of untrusted or third-party JavaScript content within Escargot-based runtimes by disabling or sandboxing external widget or web-app loading features on affected Samsung devices. Note that disabling content loading may impact device functionality such as smart TV app stores or embedded browsers. Samsung device owners should monitor Samsung's security advisories for firmware updates addressing this engine version.