Executive brief
Samsung Escargot is an open-source JavaScript engine used in various environments, including smart TVs and appliances. A vulnerability in how the engine processes certain data can allow an attacker to crash the application, leading to a denial of service. This could disrupt the normal operation of devices or software relying on this engine.
Technical details
A vulnerability exists in Samsung's Escargot JavaScript engine due to the unsafe deserialization of untrusted data. The flaw, which also involves type confusion (CWE-843), occurs when the engine processes malformed input, leading to a process abort and subsequent denial of service. While the vendor (Samsung TV & Appliance) assigned a CVSS score of 6.2 with a local attack vector, NIST's initial analysis suggests a network vector with a score of 7.5. The issue is addressed in the master branch prior to commit 97e8115ab1110bc502b4b5e4a0c689a71520d335.
Affected products
- Samsung Escargot Prior to commit 97e8115ab1110bc502b4b5e4a0c689a71520d335
Timeline
- 2026-04-08: patched: Fix merged into master branch via pull request 1554
- 2026-04-13: disclosed: Vulnerability published by Samsung and NVD