What is the CVSS score of CVE-2026-47311?

CVE-2026-47311 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung Escargot are affected by CVE-2026-47311?

Samsung's Escargot JavaScript engine, widely deployed in smart televisions, IoT devices, and industrial controllers, contains a heap overflow vulnerability enabling code execution when users process…

How to fix or mitigate CVE-2026-47311?

Within 24 hours: Create inventory of all devices/systems running Escargot engine; document business-critical applications depending on this component; contact Samsung support for patch availability and timeline. Within 7 days: Restrict JavaScript execution to digitally signed, whitelisted sources; disable Escargot engine for non-essential workloads; brief user community on risks of processing untrusted scripts. Within 30 days: Deploy vendor patch immediately upon release; if no patch timeline is provided, evaluate and migrate to alternative JavaScript runtimes with established security records (e.g., V8, SpiderMonkey).

Samsung Escargot CVE-2026-47311

EUVD-2026-30837 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-19 samsung.tv_appliance

GHSA-g7q7-7hc8-vc6w

Samsung Buffer Overflow Heap Overflow

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 06:45 vuln.today

Analysis Generated

May 19, 2026 - 06:45 vuln.today

DescriptionCVE.org

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

AnalysisAI

Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows remote attackers to corrupt heap memory and likely achieve arbitrary code execution when a victim processes attacker-controlled JavaScript. No public exploit identified at time of analysis, but the upstream fix (PR #1565) reveals multiple memory-safety hardening changes including integer underflow protection in TypedArray.copyWithin, fast-mode array conversion checks during spread operations, and OOM handling, indicating concrete reachable corruption paths. CVSS 7.8 with local attack vector and required user interaction reflects the engine's typical embedding context (apps, IoT, smart TV runtimes) rather than network-facing services.

Technical ContextAI

Escargot is a lightweight ECMAScript-compliant JavaScript engine developed by Samsung primarily for resource-constrained environments such as smart TVs, wearables, and IoT devices (CPE: cpe:2.3:a:samsung_open_source:escargot). CWE-122 (heap-based buffer overflow) here arises from multiple distinct flaws in the engine's runtime: an integer underflow in builtinTypedArrayCopyWithin where len - startIndex/len - targetIndex can become negative after buffer resize during argument coercion, then wraps when cast to size_t; an assumption-violation in arrayDefineOwnPropertyBySpreadElementOperation where setArrayLength can silently downgrade an array from fast-mode while subsequent code still touches m_fastModeData directly; and unchecked dereference of an invalid error value in Evaluator::EvaluatorResult::resultOrErrorToString during nested eval throw with finally allocation. The fix also adds ASAN macro plumbing and a GC out-of-memory handler, suggesting the affected paths were discovered through sanitizer-instrumented fuzzing.

RemediationAI

Upstream fix available (PR https://github.com/Samsung/escargot/pull/1565); a released patched version is not independently confirmed from the provided data, so consumers should rebuild from a commit at or after the merge of PR #1565 and re-vendor the engine into downstream products. Where rebuilding is not immediately feasible, compensating controls depend on how Escargot is embedded: restrict the engine to executing only signed or first-party JavaScript (eliminates the user-interaction trigger), disable or sandbox web-view/JS-runtime features in affected apps and TV channels, and where the engine is exposed via a debugger interface ensure ESCARGOT_DEBUGGER builds are not shipped to production (the patch also gates a debug-only assertion path on this define). On Samsung Tizen-based devices, apply firmware updates from the device vendor as soon as a patched build is published, and monitor https://github.com/Samsung/escargot for tagged releases incorporating the fix.