EUVD-2026-30840
GHSA-rfr8-h3jx-53jv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
Escargot is Samsung's lightweight ECMAScript engine designed for embedded and IoT environments such as Tizen-based devices, where it serves as an alternative to V8 or JavaScriptCore. CWE-416 (Use After Free) describes memory accessed after its backing allocation has been released, which in a managed-runtime context typically arises when garbage-collected objects, buffers, or references become invalidated mid-operation while still being dereferenced. The upstream PR #1565 fix touches several distinct sites - EvaluatorResult::resultOrErrorToString now validates the error value before dereferencing (nested eval/finally edge case), BuiltinTypedArray::copyWithin clamps negative lengths after buffer resize during argument coercion to prevent size_t underflow, DataViewObject reorders coercion to happen before buffer state checks, FinalizationRegistryObject nulls the source during collection to prevent finalizer reuse, and arrayDefineOwnPropertyBySpreadElement adds a fast-mode re-check after setArrayLength may have demoted the array - indicating multiple TOCTOU/lifetime issues affecting GC-tracked objects.
RemediationAI
Upstream fix available (PR https://github.com/Samsung/escargot/pull/1565); released patched version not independently confirmed, so integrators should pull the merged commit from the master branch and rebuild, or wait for the next tagged Escargot release that includes the PR's changes to EscargotPublic.cpp, BuiltinTypedArray.cpp, DataViewObject.h, FinalizationRegistryObject.cpp, and the bytecode interpreter. Where rebuilding is not yet possible, compensating controls are limited because the bug is in the engine itself: restrict the engine to executing only trusted/signed script bundles, disable or sandbox features that load remote JavaScript (e.g., third-party widgets, web views) on affected devices, and if AddressSanitizer-instrumented builds are available for testing, use them to validate the fix - note the side effect that disabling untrusted script execution may break legitimate web-facing functionality on smart-TV/appliance platforms.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today