Executive brief
Samsung Escargot, an open-source JavaScript engine often used in resource-constrained environments like smart TVs and appliances, contains a flaw in how it handles large numbers. An attacker could potentially exploit this to cause the engine to behave unpredictably or crash. This could lead to service interruptions or instability in applications that rely on this engine to process web content.
Technical details
An integer overflow (CWE-190) exists in Samsung's Escargot JavaScript engine. The vulnerability occurs when the engine processes specific numeric operations that exceed the capacity of the underlying integer type, leading to a wraparound and subsequent undefined behavior. While the vendor-provided CVSS vector suggests a local attack vector with high complexity, the NVD assessment indicates the flaw may be reachable over a network. Successful exploitation primarily impacts system availability by causing the interpreter to crash or enter an unstable state. A fix has been identified in the project's GitHub repository via pull request #1554.
Affected products
- Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335
Timeline
- 2026-04-08: patched: Fix merged in GitHub pull request 1554
- 2026-04-13: disclosed: Initial CVE publication
- 2026-06-02: advisory: NVD last modified/enriched