EUVD-2026-30837
GHSA-g7q7-7hc8-vc6w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows remote attackers to corrupt heap memory and likely achieve arbitrary code execution when a victim processes attacker-controlled JavaScript. No public exploit identified at time of analysis, but the upstream fix (PR #1565) reveals multiple memory-safety hardening changes including integer underflow protection in TypedArray.copyWithin, fast-mode array conversion checks during spread operations, and OOM handling, indicating concrete reachable corruption paths. CVSS 7.8 with local attack vector and required user interaction reflects the engine's typical embedding context (apps, IoT, smart TV runtimes) rather than network-facing services.
Technical ContextAI
Escargot is a lightweight ECMAScript-compliant JavaScript engine developed by Samsung primarily for resource-constrained environments such as smart TVs, wearables, and IoT devices (CPE: cpe:2.3:a:samsung_open_source:escargot). CWE-122 (heap-based buffer overflow) here arises from multiple distinct flaws in the engine's runtime: an integer underflow in builtinTypedArrayCopyWithin where len - startIndex/len - targetIndex can become negative after buffer resize during argument coercion, then wraps when cast to size_t; an assumption-violation in arrayDefineOwnPropertyBySpreadElementOperation where setArrayLength can silently downgrade an array from fast-mode while subsequent code still touches m_fastModeData directly; and unchecked dereference of an invalid error value in Evaluator::EvaluatorResult::resultOrErrorToString during nested eval throw with finally allocation. The fix also adds ASAN macro plumbing and a GC out-of-memory handler, suggesting the affected paths were discovered through sanitizer-instrumented fuzzing.
RemediationAI
Upstream fix available (PR https://github.com/Samsung/escargot/pull/1565); a released patched version is not independently confirmed from the provided data, so consumers should rebuild from a commit at or after the merge of PR #1565 and re-vendor the engine into downstream products. Where rebuilding is not immediately feasible, compensating controls depend on how Escargot is embedded: restrict the engine to executing only signed or first-party JavaScript (eliminates the user-interaction trigger), disable or sandbox web-view/JS-runtime features in affected apps and TV channels, and where the engine is exposed via a debugger interface ensure ESCARGOT_DEBUGGER builds are not shipped to production (the patch also gates a debug-only assertion path on this define). On Samsung Tizen-based devices, apply firmware updates from the device vendor as soon as a patched build is published, and monitor https://github.com/Samsung/escargot for tagged releases incorporating the fix.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.0.0
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.0.0.
Out-of-bounds read and reachable assertion vulnerabilities in Samsung's open-source Escargot JavaScript engine allow a l
Heap-based buffer overflow in Samsung's open-source Escargot JavaScript engine corrupts heap memory when processing mali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today