EUVD-2026-21820
GHSA-f69x-9gf3-94pj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
AnalysisAI
Out-of-bounds read in Samsung Open Source Escargot JavaScript engine allows local attackers to leak sensitive memory contents and cause denial of service. Affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and potentially other versions; the vulnerability requires local access and specific conditions to trigger but can expose confidential data and crash the application without authentication. No public exploit identified at time of analysis.
Technical ContextAI
Escargot is Samsung's lightweight JavaScript engine optimized for embedded devices and smart TV platforms. The vulnerability is an out-of-bounds read (CWE-125), a memory safety violation where the application reads memory beyond the intended buffer boundaries. This occurs in the engine's core parsing or execution logic, likely during string or array indexing operations. The CVSS vector indicates local attack vector (AV:L), suggesting the attacker must have local code execution or application access on the target device. Out-of-bounds reads can leak heap metadata, stack variables, or sensitive data stored in adjacent memory regions. The specific commit hash provided (97e8115ab1110bc502b4b5e4a0c689a71520d335) indicates a known affected version, though the wildcard CPE suggests multiple versions may be vulnerable.
RemediationAI
Samsung users should obtain the patched version of Escargot that includes the fix from GitHub pull request #1554 (https://github.com/Samsung/escargot/pull/1554). Device manufacturers and embedded system developers using Escargot should update their integration to include the out-of-bounds read fix. For Samsung appliances and smart TVs, check for firmware updates that incorporate the patched Escargot engine. Until patching is available, limiting local access to devices running Escargot and disabling JavaScript execution from untrusted sources provides temporary mitigation. Organizations should monitor Samsung security advisories for specific device firmware versions addressing this vulnerability.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today