EUVD-2026-30845
GHSA-mpg3-32g2-7qf5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condition via integer underflow in the TypedArray.prototype.copyWithin implementation, causing the engine to request a massive heap allocation and subsequently abort the process. Affected deployments include Samsung TV and appliance firmware that embeds Escargot as a scripting runtime. No public exploit code and no CISA KEV listing are present; EPSS data was not provided in available intelligence. Risk is bounded by the local attack vector and user interaction requirement in the CVSS vector.
Technical ContextAI
Escargot is Samsung's open-source C++ JavaScript engine (CPE: cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) designed for embedded and IoT platforms including Samsung smart TVs and appliances. The root cause class is CWE-789 (Memory Allocation with Excessive Size Value). The vulnerable code path is in src/builtins/BuiltinTypedArray.cpp within builtinTypedArrayCopyWithin: when TypedArray.prototype.copyWithin coerces its index arguments, a JavaScript-level side effect (such as a valueOf or toString override) can resize the underlying ArrayBuffer during coercion. After the resize, the stored array length (len) is stale, causing expressions like len - startIndex or len - targetIndex to produce negative floating-point results. These negative values are then passed to std::min and ultimately cast to size_t (an unsigned integer type), wrapping to an astronomically large value. The resulting allocation request exhausts memory. The GitHub PR #1565 diff also reveals secondary fixes: a null-pointer dereference in EscargotPublic.cpp for nested eval-throw-finally edge cases, missing fast-mode array checks in ByteCodeInterpreter.cpp after setArrayLength, coercion ordering and re-coercion prevention in DataViewObject.h, and the addition of an OOM abort handler in Heap.cpp via GC_set_oom_fn - confirming that prior to this patch, out-of-memory conditions yielded undefined behavior rather than a clean abort.
RemediationAI
Upstream fix is available via GitHub pull request #1565 at https://github.com/Samsung/escargot/pull/1565; a released tagged version incorporating this fix is not independently confirmed from available data, so downstream consumers must monitor the Samsung Escargot repository for an official release. Organizations embedding Escargot directly should apply the PR diff - specifically the count clamping fix in src/builtins/BuiltinTypedArray.cpp (adding std::max(0.0, ...) around the min expression) and the OOM abort handler in src/heap/Heap.cpp. As a compensating control, restricting the installation or execution of untrusted third-party applications on Samsung smart TV and appliance platforms reduces exposure, though this limits legitimate app ecosystem functionality. Restricting access to Escargot-powered scripting interfaces in embedded deployments (e.g., disabling developer mode or sideloading capabilities) is a more targeted mitigation with lower functional impact. Enabling ASAN builds in QA/testing pipelines is now facilitated by the ASAN detection macros added in src/Escargot.h in the same PR, which can surface similar memory issues before production release.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today