Samsung Escargot CVE-2026-58307

Exploitation requires that a user or process on the local system execute a crafted JavaScript input through an application embedding the Escargot engine (UI:R, AV:L per CVSS vector). The attacker does not require system privileges (PR:N), but must be able to supply or influence the JavaScript content processed by Escargot - for example, by placing a malicious script file that the target application then interprets. Exploitation is limited by the local attack vector (no remote network exploitation path confirmed), mandatory user interaction, and the requirement that the target platform uses an unpatched version of Escargot. Devices or applications that only process JavaScript from trusted, controlled sources are not practically exploitable.

The CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H presents a moderate, locally-scoped risk. Attack complexity is low and no privileges are required, but the local attack vector and mandatory user interaction constrain the practical threat surface significantly. The high availability impact (A:H) reflects the reachable assertion crash path, while the absence of confidentiality impact (C:N) is noteworthy given the CWE-125 classification - OOB reads typically carry information disclosure risk, but the vendor assessment indicates no confirmed data leakage. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code has been identified. Overall, this is a real but low-urgency vulnerability relevant primarily to embedded systems and device manufacturers consuming Escargot, rather than a broadly weaponizable internet-facing risk.

An attacker supplies a specially crafted JavaScript file or input string to an application or embedded device that uses Escargot as its script engine. When a local user or automated process executes the malicious script, Escargot performs an out-of-bounds read that triggers a reachable assertion, crashing the interpreter process and causing a denial of service. No public proof-of-concept exploit has been identified, but the low attack complexity suggests the crash is reproducible once a triggering input is constructed.