Executive brief
Samsung Escargot is an open-source JavaScript engine designed for high performance in resource-constrained environments. A vulnerability was identified where the engine fails to properly handle certain unusual internal conditions during script execution. This can lead to application crashes, resulting in a denial-of-service state where the software becomes unavailable to users.
Technical details
A vulnerability exists in Samsung's Escargot JavaScript engine due to an improper check for unusual or exceptional conditions, specifically involving null pointer dereferences in edge cases such as nested eval statements with finally blocks. In the affected version, the engine attempts to call toStringWithoutException on an error value without verifying if the pointer is non-null. An attacker can exploit this by providing crafted JavaScript input that triggers these edge cases, leading to a process crash (Denial of Service). The issue was addressed in pull request #1565 by adding explicit null checks before pointer dereferencing in components like EscargotPublic.cpp, BuiltinTypedArray.cpp, and JSON.cpp.
Affected products
- Samsung Escargot commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Timeline
- 2026-04-28: other: Fix pull request submitted
- 2026-05-14: patched: Fix merged into master branch
- 2026-05-19: advisory: CVE published