# CVE-2026-14160: Samsung Escargot TOCTOU race condition in Atomics operations

Source: https://junglewise.ai/threats/cve-2026-14160-samsung-escargot-toctou-race-condition-in-atomics-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-14160 · Severity: medium · CVSS 5.9 · Published 2026-06-30

Samsung Escargot, an open-source JavaScript engine, contains a flaw in how it handles memory buffers during certain operations. An attacker could exploit this to cause a system crash or potentially access data they shouldn't be able to see. This could impact the reliability of applications using this engine and lead to minor data exposure.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-14160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14160 being exploited in the wild.

**How severe is CVE-2026-14160?** Medium severity, with a CVSS score of 5.9, published 30 June 2026.

**Which products and versions are affected?** Samsung Escargot bab3a5797557014ce3c2e28419a6310cfba90d0d.

**Is there a fix for CVE-2026-14160?** A patch was published on 2026-06-29: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14160 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-14160?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-check time-of-use (TOCTOU) race condition exists in Samsung's Escargot JavaScript engine. The vulnerability is rooted in the engine's failure to revalidate ArrayBuffer status and bounds after user-controlled code execution (such as valueOf coercion) during Atomics operations. An attacker can exploit this by detaching or resizing a buffer during the coercion phase, leading to out-of-bounds (OOB) access when the operation resumes. This local attack vector allows for potential information disclosure or integrity violations. A fix has been identified in commit 9e8084e which introduces the revalidateAtomicAccess helper to verify buffer state before memory access.

## Affected products

- Samsung Escargot bab3a5797557014ce3c2e28419a6310cfba90d0d

## Timeline

- 2026-06-30: advisory: NVD publication date
- 2026-06-29: patched: Fix committed to GitHub repository

## References

- [https://github.com/Samsung/escargot/commit/9e8084ecc2f68e8584d389414c3f37fda12dab7d](https://github.com/Samsung/escargot/commit/9e8084ecc2f68e8584d389414c3f37fda12dab7d)

## Related threats

- [Samsung Escargot use-after-free in string buffer access](https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot)
- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot integer overflow in bytecode cache](https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot out-of-bounds read and reachable assertion](https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion)