Executive brief
Samsung Escargot, an open-source JavaScript engine often used in smart TVs and appliances, contains a memory management flaw. An attacker could exploit this vulnerability to cause a system crash or potentially execute unauthorized code. This could lead to a loss of service or unauthorized access to data on the affected device.
Technical details
A heap-based buffer overflow (CWE-122) exists in Samsung's Escargot JavaScript engine at commit 97e8115. The vulnerability allows for an out-of-bounds write, which can be leveraged by an attacker to corrupt memory. According to the vendor's CVSS assessment, the attack vector is local with high complexity, suggesting specific conditions or local access are required to trigger the overflow. Successful exploitation could lead to arbitrary code execution or a denial-of-service condition. A fix appears to have been addressed in pull request #1554 on the project's GitHub repository.
Affected products
- Samsung Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335
Timeline
- 2026-04-08: patched: Fix merged via GitHub Pull Request #1554
- 2026-04-13: advisory: Initial advisory published by Samsung
- 2026-04-13: disclosed: CVE-2026-25205 assigned