EUVD-2026-30844
GHSA-9c73-x399-m5pg
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Samsung Open Source gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
Executive ViewAI
Samsung's Escargot JavaScript engine contains a high-severity memory corruption vulnerability (CVE-2026-47314) that could allow local attackers to compromise system confidentiality, integrity, and availability through malicious scripts. With no public exploit identified at the time of analysis, the immediate risk is limited to insider threats or supply chain attacks; however, successful exploitation could lead to complete system compromise. Organizations using Escargot-based devices or applications should immediately inventory affected systems and implement defensive controls, as no patch is currently available from the vendor.
24 hours: Identify all systems running Samsung Escargot and restrict execution of untrusted scripts; notify information security and relevant business stakeholders. 7 days: Implement compensating controls including sandboxing and execution restrictions; complete comprehensive inventory of Escargot installations and versions across infrastructure. 30 days: Monitor Samsung security advisories for patch availability; conduct detailed risk assessment of affected applications and evaluate migration to alternative JavaScript runtimes.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict JavaScript execution to trusted sources only, implement sandboxing and containerization for Escargot-based applications, enforce principle of least privilege for process execution, disable unnecessary scripting functionality, and implement monitoring for suspicious script behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operat
Memory corruption in Samsung Open Source Escargot's code-cache and value-deserialization handling can allow unauthentica
Out-of-bounds write in Samsung Open Source Escargot JavaScript engine allows local attackers to execute arbitrary code o
Heap-based buffer overflow in Samsung Open Source Escargot JavaScript engine enables out-of-bounds memory writes with hi
Type confusion vulnerability in Samsung Open Source Escargot JavaScript engine allows local attackers with user interact
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine exposes sensitive memory content to remote attacker
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine allows local attackers to leak sensitive memory con
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Exploit-DB