Samsung Open Source EUVD-2026-21822

Local attacker with no privileges required. Affects Samsung Open Source Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. Requires specific complex conditions (AC:H) to trigger out-of-bounds write. No victim interaction needed, but local system access mandatory.

Real-world risk is moderate despite the 7.4 CVSS score. The CVSS vector reveals important constraints: local attack vector (AV:L) requires the attacker to have local access to the device running Escargot, high attack complexity (AC:H) indicates specialized conditions or race conditions must be met, and no privileges required (PR:N) with no user interaction (UI:N) means exploitation is possible but technically challenging. The unchanged scope (S:U) limits impact to the vulnerable component itself. No EPSS score is available for risk quantification, and no CISA KEV listing exists, indicating no confirmed active exploitation. The GitHub pull request reference suggests a fix is under development but not yet confirmed as merged or released. For Samsung TV and IoT deployments, the local attack vector significantly reduces immediate internet-scale risk, but the vulnerability remains critical for scenarios where attackers have physical access, malicious apps are installed, or supply chain compromise occurs. Priority should be medium-high for embedded Samsung products, lower for general enterprise environments.

An attacker with local access to a Samsung smart TV or IoT device running the vulnerable Escargot engine crafts a malicious JavaScript payload designed to trigger the out-of-bounds write condition during script parsing or execution. By carefully manipulating input buffers through a malicious web page, local application, or USB-delivered content, the attacker overwrites adjacent memory regions to hijack control flow. Despite high attack complexity requiring precise memory layout knowledge and timing, successful exploitation grants arbitrary code execution with the privileges of the Escargot process, potentially allowing the attacker to install persistent malware, exfiltrate data from the device, or pivot to other devices on the local network.