Samsung Escargot CVE-2026-47316

Local access to the target host is required (AV:L); remote exploitation over a network is not possible per the CVSS vector. User interaction is required (UI:R), meaning a user or local process must invoke an application that embeds Escargot and passes attacker-influenced JavaScript to the engine - for example, a smart TV app that evaluates user-supplied or network-fetched scripts locally. Three specific JavaScript constructs are needed to trigger the respective crash paths: (1) a TypedArray.copyWithin() call on a TypedArray whose backing ResizableArrayBuffer is resized during argument coercion (requires ResizableArrayBuffer support enabled); (2) a nested eval() containing throw inside a finally block that causes GC allocation, producing a null error value; (3) an array spread literal of sufficient size to cause setArrayLength() to demote the array from fast mode to slow mode mid-operation. No authentication bypass is involved, and confidentiality and integrity are unaffected per CVSS C:N/I:N.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a locally-triggered, user-interaction-dependent crash with no confidentiality or integrity impact - this is a DoS-only vulnerability. The attack complexity is Low and no privileges are required, but the local-only attack vector and mandatory user interaction significantly bound real-world risk to environments where an adversary can influence JavaScript input to an Escargot-embedding application. EPSS data is not available in the provided intelligence. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Notably, the metadata tags include 'Information Disclosure', which directly conflicts with the CVSS C:N rating; this discrepancy is unresolved and the CVSS vector should be treated as authoritative until the vendor clarifies. The batch nature of fixes in PR #1565 suggests these are clustered edge-case stability bugs rather than a single targeted attack surface, further reducing the likelihood of opportunistic exploitation.

An attacker with local access to a Samsung smart TV or IoT appliance application that embeds Escargot crafts a JavaScript payload that calls TypedArray.copyWithin() on a TypedArray backed by a ResizableArrayBuffer, then triggers a buffer resize during argument coercion. This causes len - startIndex to evaluate to a negative number, which wraps to a massive size_t value, producing an out-of-bounds memory operation that crashes the JavaScript engine process. A separate path involves constructing a nested eval() with a throw statement inside a finally block that triggers garbage collection, producing a null error value that is subsequently dereferenced in resultOrErrorToString(), causing a null pointer dereference crash. No public exploit code has been identified at time of analysis.