What is the CVSS score of CVE-2026-47317?

CVE-2026-47317 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Samsung Escargot CVE-2026-47317

EUVD-2026-30850 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-05-19 samsung.tv_appliance

GHSA-rmj6-ch86-hm24

Information Disclosure Samsung

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 08:33 vuln.today

Analysis Generated

May 19, 2026 - 08:33 vuln.today

DescriptionCVE.org

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

AnalysisAI

Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-service condition with high availability impact. The vulnerability affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3 of the Escargot engine, which is deployed in Samsung smart TV and appliance firmware. No public exploit code exists and no active exploitation is confirmed by CISA KEV; however, the fix PR reveals multiple heap exhaustion and integer underflow scenarios addressable through crafted JavaScript inputs.

Technical ContextAI

Escargot (CPE: cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is Samsung's open-source JavaScript engine, primarily embedded in Samsung Smart TV and appliance firmware rather than desktop browsers. The root cause is CWE-674 (Uncontrolled Recursion), where recursive JavaScript execution paths are not sufficiently bounded, leading to uncontrolled heap growth. The fix PR #1565 reveals several contributing code paths: the garbage collector lacked an OOM abort handler (fixed by adding GC_set_oom_fn with abort()), TypedArray.copyWithin suffered integer underflow when buffer resize during argument coercion produced negative values cast to size_t (count now clamped to non-negative with std::max(0.0, ...)), nested eval/throw/finally blocks could dereference an invalid or null error value, and arrays transitioning from fast-mode to non-fast-mode during spread operations lacked a slow-path fallback. The combination of these defects means specially crafted recursive or deeply nested JavaScript can exhaust allocator capacity.

RemediationAI

The upstream fix is available in Samsung's GitHub repository as pull request #1565 (https://github.com/Samsung/escargot/pull/1565). This PR delivers several correlated fixes: an OOM abort handler to halt allocation runaway, a non-negative clamp on TypedArray.copyWithin count, a null guard for error values in nested eval/throw/finally paths, and a fast-to-non-fast array mode slow-path. Upstream fix available (PR/commit); a released patched version or firmware build number has not been independently confirmed from available data - monitor Samsung's open-source security advisories for a tagged Escargot release incorporating these changes. For Samsung TV or appliance deployments, apply firmware updates as released by Samsung. As a compensating control where firmware updates are not yet available, restrict untrusted or third-party application installation on affected Samsung devices to prevent delivery of crafted JavaScript. Disabling features that allow sideloaded or web-based JavaScript execution reduces attack surface but may impact device functionality.