Samsung Escargot EUVD-2026-30847

Local access is required (AV:L) - remote network exploitation is not possible per the CVSS vector. User interaction is required (UI:R), meaning a user must take an action such as opening a crafted application, webpage, or script processed by the Escargot runtime. No special privileges are required (PR:N) beyond the ability to deliver JavaScript to the engine. Each defect has a specific trigger condition: the null error-value crash requires a nested eval containing a throw inside a finally block that causes allocation during exception unwinding; the integer underflow requires a TypedArray.copyWithin call on a buffer that is resized during argument coercion (e.g., via a valueOf() side effect); the OOM crash requires allocating enough heap to exhaust GC memory; the fast-mode array assertion requires a spread operation that causes an array to exceed its fast-mode length threshold during element assignment. Exploitation is limited to contexts where an attacker can supply JavaScript input to an Escargot-powered runtime - primarily embedded Samsung platforms. The unchanged scope (S:U) means the impact is confined to the Escargot process itself.

The CVSS 5.5 Medium score reflects a local, user-interaction-required availability impact with no confidentiality or integrity consequence (C:N/I:N/A:H). Real-world risk is moderate-to-low for most enterprise environments but may be elevated in embedded product contexts (Samsung TV/appliance firmware) where the JavaScript engine processes untrusted web content or app scripts without strong process isolation. Notably, the metadata tags label this 'Information Disclosure,' which directly conflicts with the CVSS vector's C:N and I:N scores - this appears to be a tagging error, and the actual impact based on both the CVSS and the code diff is availability-only (engine crash or abort()). The description's phrase 'Input Data Manipulation' similarly conflicts with I:N; this language likely derives from the generic CWE-754 taxonomy rather than reflecting a confirmed integrity impact. No EPSS score was provided in the intelligence data. No KEV listing exists. No public exploit code has been identified. The upstream fix exists only as an unmerged or recently merged PR (#1565), meaning no independently verified patched release version is available. Risk is context-dependent: embedded Samsung devices processing untrusted JS content face real crash exposure; server-side or desktop use of Escargot is atypical.

A local attacker or malicious JavaScript payload delivered to a Samsung device (e.g., via a crafted smart TV application or web content processed by the Escargot engine) could trigger one of the unhandled conditions - for example, executing a TypedArray.copyWithin operation on a resizable buffer while coercing arguments, causing integer underflow and a subsequent engine abort. User interaction is required per the CVSS vector (UI:R), consistent with a scenario where a user opens or interacts with crafted content. No public exploit code has been identified, but the detailed PR diff provides sufficient information to reconstruct proof-of-concept test cases.