EUVD-2026-42575
GHSA-q26j-g249-rwxv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Local vector and user interaction required to feed malicious JS; no privileges needed; availability-dominant impact with no confidentiality exposure.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
1DescriptionCVE.org
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.
AnalysisAI
Heap-based buffer overflow in Samsung's open-source Escargot JavaScript engine corrupts heap memory when processing maliciously crafted input, leading to a high-severity availability impact and a limited integrity impact. The vulnerability affects all Escargot releases before commit ef525f337fafddecde77a3c426212a84bb20cb98, targeting embedded and IoT contexts where the engine is deployed - most notably Samsung TV appliances. No public exploit identified at time of analysis, and no CISA KEV listing, but the local-vector, low-complexity nature of heap overflows makes this reliably triggerable once an attacker can supply crafted input to the engine.
Technical ContextAI
Escargot (CPE: cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is Samsung's open-source, lightweight JavaScript engine, designed for resource-constrained and embedded environments such as Samsung smart TVs. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the engine fails to perform adequate bounds checking when writing into a heap-allocated buffer during JavaScript parsing or runtime execution, resulting in a write operation beyond the intended allocation boundary. This class of flaw can corrupt adjacent heap metadata or object data. The attack vector is local (AV:L), meaning the exploit is triggered by feeding the engine malicious JavaScript content - consistent with how an embedded JS interpreter processes scripts on-device. User interaction is required (UI:R), indicating a user or system process must invoke the engine against attacker-controlled input.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Consumers of the Escargot library should update to or build from a commit at or after ef525f337fafddecde77a3c426212a84bb20cb98, referencing the fix in GitHub PR #1584 (https://github.com/Samsung/escargot/pull/1584). Samsung device users should apply firmware updates from Samsung as they become available, as the embedded engine version is not directly user-configurable. As a compensating control pending a patch, restrict the execution of untrusted or third-party JavaScript content on affected devices - on Samsung TV platforms this may mean disabling or sandboxing app sideloading mechanisms. Blocking untrusted content delivery channels reduces the UI:R prerequisite from being satisfied. No generic workarounds address the underlying memory safety defect; source-level bounds checking or compiler hardening (e.g., AddressSanitizer in dev builds) should be applied during validation of the patched commit.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today