Samsung Open Source EUVD-2026-21820

The CVSS score of 6.7 (medium-high) reflects moderate real-world risk despite the local attack vector requirement. The vector breakdown shows high confidentiality impact (C:H) from memory leakage and high availability impact (A:H) from potential denial of service, balanced by low complexity to exploit (AC:H indicates moderate difficulty). EPSS data is not provided, limiting probabilistic exploitation assessment. The absence of KEV status and confirmed public exploits suggests this is not actively exploited in the wild at time of analysis. However, the vulnerability's presence in a widely-used embedded JavaScript engine for Samsung devices (smart TVs, appliances) increases practical significance-any application running Escargot on user-accessible systems becomes a potential attack surface. The local-only requirement and need for specific triggering conditions limit immediate threat scope, but in multi-tenant or compromised device scenarios, an attacker with local access could systematically extract sensitive data from the JavaScript engine's memory state. This is a moderate-priority fix for embedded device manufacturers using Escargot.

A local attacker with access to a Samsung smart TV or appliance gains the ability to run code or scripts on the device. The attacker crafts a malicious JavaScript program that triggers the out-of-bounds read in Escargot's memory handling, reading sensitive data from adjacent memory regions such as cryptographic keys, user credentials, or other application data. The attacker exfiltrates this leaked memory or triggers a crash to cause denial of service on the device.