EUVD-2026-42574
GHSA-f5pv-4r42-w7j4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Local delivery of malicious JS requires user interaction; no privileges needed; availability high from crash, integrity low from pointer manipulation, no confidentiality impact per available data.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.
AnalysisAI
Type confusion (CWE-843) in Samsung's open-source Escargot JavaScript engine enables pointer manipulation, leading to high-impact availability disruption and limited integrity compromise when processing malicious JavaScript. All Escargot versions prior to commit 779f6bedf58f334dec64b0a51ebb724b4708b84a are affected, with particular relevance to Samsung embedded and smart appliance ecosystems where this engine is deployed. No public exploit has been identified at time of analysis, and an upstream fix is available via GitHub PR #1580, though a formally versioned release has not been independently confirmed.
Technical ContextAI
Escargot (CPE: cpe:2.3:a:samsung_open_source:escargot:*:*:*:*:*:*:*:*) is Samsung's lightweight open-source JavaScript engine, designed for resource-constrained embedded and IoT devices including Samsung TV appliances. CWE-843 (Type Confusion) occurs when a resource is accessed using a type incompatible with how it was allocated or initialized - in a JavaScript engine context, this typically arises when the engine's internal object type tags or shape information is not correctly validated before pointer dereference, allowing attacker-controlled JavaScript to confuse the engine into treating one object type as another. This class of flaw in JS engines is well-understood: it allows pointer manipulation that can corrupt the heap, crash the process (Availability: High), or in more severe cases enable memory writes at attacker-influenced addresses (Integrity: Low). The CVSS vector AV:L/UI:R reflects that exploitation occurs locally when a user or process causes the engine to evaluate a crafted script.
RemediationAI
The primary remediation is to update Escargot to a build incorporating commit 779f6bedf58f334dec64b0a51ebb724b4708b84a or later, as introduced in GitHub PR #1580 (https://github.com/Samsung/escargot/pull/1580). Note that this is an upstream commit reference, not a formally tagged release - organizations should verify with Samsung or their device vendor whether a patched firmware or library version has been formally distributed. For embedded and appliance deployments where patching is not immediately feasible, restrict the sources of JavaScript content evaluated by Escargot to trusted, internally controlled inputs only; if the engine evaluates externally sourced scripts (e.g., from network resources or user-supplied files), disabling that input path eliminates the attack surface with the trade-off of reduced functionality. Monitor GitHub issue #1574 and Samsung security advisories for an official versioned patch release.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today