What is the CVSS score of CVE-2026-47310?

CVE-2026-47310 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung Escargot are affected by CVE-2026-47310?

Samsung's Escargot JavaScript engine contains a high-severity use-after-free vulnerability (CVE-2026-47310, CVSS 7.8) that enables memory corruption through crafted JavaScript content, affecting…

How to fix or mitigate CVE-2026-47310?

Within 24 hours: Inventory all products, services, and applications using Samsung Escargot JavaScript engine (identify by commit 590345cc6258317c5da850d846ce6baaf2afc2d3 or earlier versions) and classify by risk exposure. Within 7 days: Restrict Escargot engine to execution of code from trusted sources only; implement process isolation and sandboxing for JavaScript execution contexts; disable the engine in non-critical workflows. Within 30 days: Establish daily monitoring of Samsung security advisories for patch release announcements; engage vendor support for timeline; evaluate migration to alternative JavaScript engines where operationally feasible.

Samsung Escargot CVE-2026-47310

EUVD-2026-30840 HIGH

Use After Free (CWE-416)

2026-05-19 samsung.tv_appliance

GHSA-rfr8-h3jx-53jv

Memory Corruption Samsung Denial Of Service Use After Free

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 06:45 vuln.today

Analysis Generated

May 19, 2026 - 06:45 vuln.today

DescriptionCVE.org

Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

AnalysisAI

Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Escargot is Samsung's lightweight ECMAScript engine designed for embedded and IoT environments such as Tizen-based devices, where it serves as an alternative to V8 or JavaScriptCore. CWE-416 (Use After Free) describes memory accessed after its backing allocation has been released, which in a managed-runtime context typically arises when garbage-collected objects, buffers, or references become invalidated mid-operation while still being dereferenced. The upstream PR #1565 fix touches several distinct sites - EvaluatorResult::resultOrErrorToString now validates the error value before dereferencing (nested eval/finally edge case), BuiltinTypedArray::copyWithin clamps negative lengths after buffer resize during argument coercion to prevent size_t underflow, DataViewObject reorders coercion to happen before buffer state checks, FinalizationRegistryObject nulls the source during collection to prevent finalizer reuse, and arrayDefineOwnPropertyBySpreadElement adds a fast-mode re-check after setArrayLength may have demoted the array - indicating multiple TOCTOU/lifetime issues affecting GC-tracked objects.

RemediationAI

Upstream fix available (PR https://github.com/Samsung/escargot/pull/1565); released patched version not independently confirmed, so integrators should pull the merged commit from the master branch and rebuild, or wait for the next tagged Escargot release that includes the PR's changes to EscargotPublic.cpp, BuiltinTypedArray.cpp, DataViewObject.h, FinalizationRegistryObject.cpp, and the bytecode interpreter. Where rebuilding is not yet possible, compensating controls are limited because the bug is in the engine itself: restrict the engine to executing only trusted/signed script bundles, disable or sandbox features that load remote JavaScript (e.g., third-party widgets, web views) on affected devices, and if AddressSanitizer-instrumented builds are available for testing, use them to validate the fix - note the side effect that disabling untrusted script execution may break legitimate web-facing functionality on smart-TV/appliance platforms.