# CVE-2026-124684: Samsung Escargot use-after-free in string buffer access

Source: https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124684 · Severity: medium · CVSS 5.1 · Published 2026-11-09

Samsung Escargot is a JavaScript engine used in embedded systems and applications. A use-after-free vulnerability in its string buffer handling allows attackers to manipulate memory pointers, potentially enabling code execution or system compromise when processing untrusted scripts.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-124684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124684 being exploited in the wild.

**How severe is CVE-2026-124684?** Medium severity, with a CVSS score of 5.1, published 9 November 2026.

**Which products and versions are affected?** Samsung Escargot before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5.

**Is there a fix for CVE-2026-124684?** Yes: fixed in 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124684 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124684?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8bc35b7b88f0f96c66a42aa965a1a710308b61d5

## Technical details

A use-after-free vulnerability exists in ReloadableString and CompressibleString classes where raw buffer pointers extracted via characters8() and characters16() methods could be invalidated if garbage collection or idle-mode compaction ran before use. Additionally, the public StringBufferAccessDataRef API lacked reference-counting semantics, allowing embedders to hold stale buffer pointers after idle mode entry. The fix removes the vulnerable methods and adds reference-counted lifetime tracking to StringBufferAccessDataRef.

## Affected products

- Samsung Escargot before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5

## Timeline

- 2026-11-09: disclosed
- 2026-09-30: patched

## References

- [https://github.com/Samsung/escargot/commit/8bc35b7b88f0f96c66a42aa965a1a710308b61d5](https://github.com/Samsung/escargot/commit/8bc35b7b88f0f96c66a42aa965a1a710308b61d5)

## Related threats

- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot integer overflow in bytecode cache](https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot out-of-bounds read and reachable assertion](https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion)
- [Samsung Escargot heap buffer overflow in ByteCodeInterpreter](https://junglewise.ai/threats/cve-2026-58306-samsung-escargot-heap-buffer-overflow-in-bytecodeinterpreter)