Executive brief
A security vulnerability exists in Samsung's Escargot, an open-source JavaScript engine often used in smart TVs and appliances. This flaw could allow an attacker to manipulate system memory, potentially leading to unauthorized data access or system crashes. To exploit this, an attacker would typically need to trick a user into running a malicious script or opening a specially crafted file.
Technical details
A use-after-free (UAF) vulnerability exists in the Samsung Escargot JavaScript engine (specifically identified in commit 590345c). The flaw stems from improper memory management during pointer operations, which can be triggered during edge cases such as nested eval calls or specific error handling routines. An attacker can exploit this by providing malicious JavaScript that triggers the UAF condition, leading to pointer manipulation. This can result in a crash (denial of service) or potentially arbitrary code execution with the privileges of the application using the engine. The issue was addressed in pull request #1565.
Affected products
- Samsung Escargot 590345cc6258317c5da850d846ce6baaf2afc2d3
Timeline
- 2026-04-28: other: Fix initially proposed in pull request
- 2026-05-14: patched: Fix merged into master branch
- 2026-05-19: disclosed: CVE published to NVD