Samsung Escargot CVE-2026-58304

Exploitation requires local execution of crafted JavaScript content within the Escargot engine, as confirmed by the CVSS AV:L (local attack vector). User interaction is required (UI:R), meaning a user must actively trigger execution of the malicious script - such as launching an application or loading content that invokes the engine. No elevated privileges are required (PR:N), so any user with the ability to run JavaScript on the affected platform is a potential vector. Exploitation is limited by: the local-only attack vector (no direct remote network exploitation), the requirement for user interaction, and the restricted deployment context of Escargot to Samsung TV appliance and IoT platforms rather than general-purpose desktop or server environments. Unauthenticated remote network-based exploitation is not supported by the provided CVSS vector.

CVSS 3.1 scores this at 6.1 Medium with AV:L/AC:L/PR:N/UI:R - meaning local access and user interaction are both required, substantially reducing the real-world attack surface compared to a network-exploitable flaw. No EPSS data was provided, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. POC availability is unknown - GitHub issue #1573 documents the bug report but no standalone exploit code is cited. The SSVC automatable dimension is effectively 'No' given the local attack vector and required user interaction. The high availability impact (A:H) is the dominant risk signal: a crash of the JavaScript engine in an embedded TV or IoT context could disable application functionality. The official C:N (no confidentiality impact) conflicts with the 'Information Disclosure' tag and the CWE-125 root cause - defenders should treat memory leak risk as plausible but unconfirmed. Overall, this is a moderate-priority patching item for Samsung platform maintainers, with limited urgency for most enterprise security teams due to the niche deployment footprint.

A threat actor crafts a malicious JavaScript file or application containing input specifically designed to trigger the out-of-bounds read or write condition within Escargot's parsing or execution path. When a user on a Samsung TV or IoT device runs or loads this content - for example, by launching a sideloaded app or interacting with crafted media - the engine processes the malicious script locally, resulting in memory corruption that crashes the JavaScript runtime or leaks adjacent heap memory. No public proof-of-concept code is known to exist at time of analysis.