EUVD-2026-30846
GHSA-9726-5rh7-2mr9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from multiple improper exceptional-condition handling paths exposed during JavaScript execution: a null pointer dereference when resolving error values in nested eval/throw/finally scenarios, an integer underflow in TypedArray.copyWithin() triggered by resizable ArrayBuffer coercion, and an unguarded assertion failure when array objects transition unexpectedly from fast to slow mode. Attack vector is local and requires user interaction (UI:R), with impact confined entirely to availability - crashing the host process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Escargot is Samsung's open-source embeddable JavaScript engine, commonly used in Samsung smart TV and IoT appliance contexts (reporter tagged as samsung.tv_appliance). The root cause class is CWE-703 (Improper Check or Handling of Exceptional Conditions), and the PR #1565 diff reveals at least four distinct failure paths. First, EscargotPublic.cpp lacked a null guard before dereferencing error.value() in resultOrErrorToString(), which can be invalid during nested eval() with throw inside a finally block that triggers GC allocation. Second, BuiltinTypedArray.cpp computed copy counts for TypedArray.copyWithin() without clamping: after a ResizableArrayBuffer is resized during argument coercion, the expression len - startIndex or len - targetIndex can go negative, and casting a negative double to size_t produces an enormous value causing an out-of-bounds operation. Third, ByteCodeInterpreter.cpp assumed via ASSERT that an array remains in fast mode after setArrayLength(), but setArrayLength() can silently demote arrays to slow mode when thresholds are exceeded, causing an assertion failure in debug builds and undefined behavior in release builds. Fourth, Heap.cpp had no deterministic out-of-memory handler; the fix installs a GC OOM callback that calls abort() for predictable failure. The CPE is cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:* at the specific affected commit.
RemediationAI
Apply the upstream fix available in GitHub PR #1565 at https://github.com/Samsung/escargot/pull/1565, which patches all four identified exceptional-condition handling defects. Note that this is a pull request or commit-level fix; a tagged stable release incorporating this patch has not been independently confirmed at time of analysis, so organizations building Escargot from source should cherry-pick or merge PR #1565 directly. As a compensating control where patching is not immediately possible, restrict the Escargot embedding process to execute only trusted JavaScript and run the embedding process in an isolated sandbox (e.g., a separate process or container) so that a crash does not propagate to critical system components - this limits the blast radius of the availability impact but does not prevent the crash itself. Disabling user-controlled JavaScript input to Escargot-hosted features until patched is the most effective interim measure.
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.0.0
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific
Uncontrolled recursion in Samsung's Escargot JavaScript engine crashes the runtime when processing oversized serialized
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.0.0.
Out-of-bounds read and reachable assertion vulnerabilities in Samsung's open-source Escargot JavaScript engine allow a l
Heap-based buffer overflow in Samsung's open-source Escargot JavaScript engine corrupts heap memory when processing mali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today