EUVD-2026-30847
GHSA-4q76-r9jm-m677
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional conditions - including a null error-value dereference during nested eval/throw/finally sequences, integer underflow in TypedArray.copyWithin after runtime buffer resize, an unhandled out-of-memory condition in the garbage collector, and an invalid fast-mode array assertion during spread operations. Exploitation requires local access and user interaction (AV:L/UI:R per CVSS), crashing or aborting the Escargot runtime process. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available as GitHub PR #1565 but no tagged release version has been confirmed.
Technical ContextAI
Escargot (CPE: cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is a lightweight, embedded JavaScript engine developed by Samsung Open Source, primarily targeting resource-constrained environments such as Samsung smart TVs and appliances (consistent with the 'samsung.tv_appliance' reporter identifier). CWE-754 (Improper Check for Unusual or Exceptional Conditions) covers a class of bugs where the software does not adequately check for or handle exceptional runtime states. The PR diff reveals at least five distinct defects: (1) EscargotPublic.cpp dereferences an error value without first verifying hasValue(), exploitable via crafted nested eval-throw-finally patterns that trigger allocation during unwinding; (2) BuiltinTypedArray.cpp computes a count that can go negative after a resizable ArrayBuffer is modified during argument coercion, causing integer underflow when cast to size_t; (3) Heap.cpp lacked an OOM callback, allowing the GC allocator to silently fail; (4) ByteCodeInterpreter.cpp assumed arrays remain in fast mode after setArrayLength, an invalid invariant when length thresholds are exceeded during spread; (5) DataViewObject.h re-coerced a numeric value after buffer state changed, introducing a TOCTOU-style inconsistency. All defects share the CWE-754 root cause: missing guards for states that the engine's implicit invariants assumed could not occur.
RemediationAI
The upstream fix is available as GitHub PR #1565 (https://github.com/Samsung/escargot/pull/1565), which patches all five identified defects across EscargotPublic.cpp, BuiltinTypedArray.cpp, Heap.cpp, ByteCodeInterpreter.cpp, DataViewObject.h, and FinalizationRegistryObject.cpp. A patched tagged release version has not been independently confirmed - this is a PR/commit-level fix, not a versioned release. Consumers of Escargot as a library should build from a commit after this PR is merged and verify the fix is included. For embedded platform operators (Samsung TV/appliance firmware), apply the OEM firmware update once Samsung releases a patched build incorporating this fix. As a compensating control where patching is not immediately possible, restricting the source and content of JavaScript processed by the Escargot runtime - for example, disabling execution of third-party or untrusted scripts - reduces crash exposure, though this may limit platform functionality. Enabling AddressSanitizer (ASAN) builds for testing environments is now natively supported by the PR's new ASAN detection macros and can help detect further memory-safety edge cases before production deployment.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.0.0
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.0.0.
Out-of-bounds read and reachable assertion vulnerabilities in Samsung's open-source Escargot JavaScript engine allow a l
Heap-based buffer overflow in Samsung's open-source Escargot JavaScript engine corrupts heap memory when processing mali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today