EUVD-2026-30848
GHSA-3hmv-xgq6-6pp3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
AnalysisAI
Denial-of-service via invalid pointer dereference in Samsung Open Source Escargot JavaScript engine affects the specific commit 590345cc6258317c5da850d846ce6baaf2afc2d3, allowing a locally-present attacker to crash the runtime through crafted JavaScript. The root cause (CWE-763) involves unconditional dereference of a potentially invalid or null error pointer in the resultOrErrorToString path, triggerable via nested eval/throw/finally patterns that induce GC allocation during exception handling. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Technical ContextAI
Escargot is a lightweight JavaScript engine developed by Samsung Open Source, designed for embedded platforms including smart TVs and appliances (reporter: samsung.tv_appliance). CWE-763 describes the release or use of an invalid memory reference. The primary defect, visible in PR #1565 diff of EscargotPublic.cpp, is that resultOrErrorToString unconditionally casts and dereferences error.value() as a ValueRef* without first validating it - a situation that arises in edge cases where a nested eval with throw inside a finally block triggers a GC allocation, leaving the error slot in an invalid or null state. Secondary fixes in the same PR address a related integer underflow in BuiltinTypedArray.cpp's copyWithin implementation (buffer resize during argument coercion can yield negative values that underflow when cast to size_t), unsafe fast-mode array state assumptions in ByteCodeInterpreter.cpp, coercion-order bugs in DataViewObject.h, and an OOM abort handler in Heap.cpp. CPE cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:* covers the Samsung Open Source Escargot product line broadly; the advisory narrows the confirmed affected artifact to the named commit.
RemediationAI
The upstream fix is available via GitHub Pull Request #1565 at https://github.com/Samsung/escargot/pull/1565. A versioned, tagged release incorporating this fix has not been independently confirmed - the patch exists as an upstream PR/commit only, and no released patched version is cited in the advisory. Organizations embedding Escargot should update their Escargot dependency to a commit at or after the merge of PR #1565 and rebuild affected firmware or application packages. As a compensating control prior to patching, restrict the Escargot runtime from executing untrusted or externally-supplied JavaScript; in Samsung appliance contexts this may mean disabling or sandboxing user-accessible scripting surfaces. No additional vendor advisory URL is available beyond the GitHub PR reference.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today