Quick answers
- Is CVE-2026-47315 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47315 being exploited in the wild.
- How severe is CVE-2026-47315?
- Medium severity, with a CVSS score of 5.5, published 19 May 2026.
- Which products and versions are affected?
- Samsung Escargot commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Is there a fix for CVE-2026-47315?
- A patch was published on 2026-05-14: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47315 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-47315?
- Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in Samsung's Escargot JavaScript engine due to an improper check for unusual or exceptional conditions, specifically involving null pointer dereferences in edge cases such as nested eval statements with finally blocks. In the affected version, the engine attempts to call toStringWithoutException on an error value without verifying if the pointer is non-null. An attacker can exploit this by providing crafted JavaScript input that triggers these edge cases, leading to a process crash (Denial of Service). The issue was addressed in pull request #1565 by adding explicit null checks before pointer dereferencing in components like EscargotPublic.cpp, BuiltinTypedArray.cpp, and JSON.cpp.
Affected products
- Samsung Escargot commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Timeline
- 2026-04-28: other: Fix pull request submitted
- 2026-05-14: patched: Fix merged into master branch
- 2026-05-19: advisory: CVE published