# CVE-2026-40447: Samsung Escargot integer overflow in JavaScript engine

Source: https://junglewise.ai/threats/cve-2026-40447-samsung-escargot-integer-overflow-in-javascript-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-40447 · Severity: medium · CVSS 5.1 · Published 2026-04-13

Samsung Escargot, an open-source JavaScript engine often used in resource-constrained environments like smart TVs and appliances, contains a flaw in how it handles large numbers. An attacker could potentially exploit this to cause the engine to behave unpredictably or crash. This could lead to service interruptions or instability in applications that rely on this engine to process web content.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-40447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40447 being exploited in the wild.

**How severe is CVE-2026-40447?** Medium severity, with a CVSS score of 5.1, published 13 April 2026.

**Which products and versions are affected?** Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335.

**Is there a fix for CVE-2026-40447?** A patch was published on 2026-04-08: Fix merged in GitHub pull request 1554 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40447 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-40447?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow (CWE-190) exists in Samsung's Escargot JavaScript engine. The vulnerability occurs when the engine processes specific numeric operations that exceed the capacity of the underlying integer type, leading to a wraparound and subsequent undefined behavior. While the vendor-provided CVSS vector suggests a local attack vector with high complexity, the NVD assessment indicates the flaw may be reachable over a network. Successful exploitation primarily impacts system availability by causing the interpreter to crash or enter an unstable state. A fix has been identified in the project's GitHub repository via pull request #1554.

## Affected products

- Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335

## Timeline

- 2026-04-08: patched: Fix merged in GitHub pull request 1554
- 2026-04-13: disclosed: Initial CVE publication
- 2026-06-02: advisory: NVD last modified/enriched

## References

- [https://github.com/Samsung/escargot/pull/1554](https://github.com/Samsung/escargot/pull/1554)

## Related threats

- [Samsung Escargot use-after-free in string buffer access](https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot)
- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot integer overflow in bytecode cache](https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot out-of-bounds read and reachable assertion](https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion)