Executive brief
Samsung's Escargot, an open-source JavaScript engine often used in smart TVs and appliances, contains a memory management flaw. If a user is tricked into running a malicious script or opening a specially crafted file, an attacker could potentially crash the application or execute unauthorized code. This could lead to a full compromise of the device's software environment and unauthorized access to data.
Technical details
A heap-based buffer overflow (CWE-122) exists in Samsung's Escargot JavaScript engine. The vulnerability is triggered when the engine handles specific edge cases during memory allocation or script evaluation, such as nested eval calls or invalid error value handling in the API. An attacker can exploit this by providing a crafted JavaScript payload that requires user interaction (UI:R) to be executed locally. Successful exploitation can lead to arbitrary code execution or a denial-of-service (crash) within the context of the engine. A fix has been identified in the project's pull request #1565 which addresses various crash issues and pointer dereference safety.
Affected products
- Samsung Escargot 590345cc6258317c5da850d846ce6baaf2afc2d3
Timeline
- 2026-04-28: other: Initial fix pull request submitted to GitHub
- 2026-05-14: patched: Fix merged into master branch
- 2026-05-19: disclosed: CVE published to NVD