What is the CVSS score of CVE-2026-47314?

CVE-2026-47314 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung are affected by CVE-2026-47314?

Samsung's Escargot JavaScript engine contains a high-severity memory corruption vulnerability (CVE-2026-47314) that could allow local attackers to compromise system confidentiality, integrity, and…

How to fix or mitigate CVE-2026-47314?

24 hours: Identify all systems running Samsung Escargot and restrict execution of untrusted scripts; notify information security and relevant business stakeholders. 7 days: Implement compensating controls including sandboxing and execution restrictions; complete comprehensive inventory of Escargot installations and versions across infrastructure. 30 days: Monitor Samsung security advisories for patch availability; conduct detailed risk assessment of affected applications and evaluate migration to alternative JavaScript runtimes.

Samsung CVE-2026-47314

EUVD-2026-30844 HIGH

Out-of-bounds Write (CWE-787)

2026-05-19 samsung.tv_appliance

GHSA-9c73-x399-m5pg

Memory Corruption Samsung Buffer Overflow

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 08:30 vuln.today

Analysis Generated

May 19, 2026 - 08:30 vuln.today

DescriptionCVE.org

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

AnalysisAI

Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list.