Quick answers
- Is CVE-2026-40447 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40447 being exploited in the wild.
- How severe is CVE-2026-40447?
- Medium severity, with a CVSS score of 5.1, published 13 April 2026.
- Which products and versions are affected?
- Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Is there a fix for CVE-2026-40447?
- A patch was published on 2026-04-08: Fix merged in GitHub pull request 1554 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40447 attacked?
- It is attacked with local access or over the network, in a software library.
- Am I affected by CVE-2026-40447?
- Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow (CWE-190) exists in Samsung's Escargot JavaScript engine. The vulnerability occurs when the engine processes specific numeric operations that exceed the capacity of the underlying integer type, leading to a wraparound and subsequent undefined behavior. While the vendor-provided CVSS vector suggests a local attack vector with high complexity, the NVD assessment indicates the flaw may be reachable over a network. Successful exploitation primarily impacts system availability by causing the interpreter to crash or enter an unstable state. A fix has been identified in the project's GitHub repository via pull request #1554.
Affected products
- Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335
Timeline
- 2026-04-08: patched: Fix merged in GitHub pull request 1554
- 2026-04-13: disclosed: Initial CVE publication
- 2026-06-02: advisory: NVD last modified/enriched