Executive brief
Samsung Escargot, an open-source JavaScript engine often used in smart TVs and appliances, contains a vulnerability that can cause the software to crash. By providing specifically crafted input that triggers excessive internal repetition, an attacker can force the system to run out of memory or stack space. This results in a denial-of-service, potentially causing applications or devices using the engine to become unresponsive.
Technical details
A vulnerability classified as uncontrolled recursion (CWE-674) exists in Samsung's Escargot JavaScript engine at commit 590345c. The flaw occurs when the engine processes certain nested or recursive structures, leading to excessive stack or memory allocation. An attacker can exploit this by providing malicious JavaScript code or JSON data that triggers deep recursion, resulting in a stack overflow or exhaustion of system resources. This leads to a denial-of-service (DoS) condition. The issue was addressed in pull request #1565, which includes fixes for crash issues in components such as BuiltinTypedArray and JSON parsing.
Affected products
- Samsung Escargot 590345cc6258317c5da850d846ce6baaf2afc2d3
Timeline
- 2026-04-28: other: Fixes submitted via pull request
- 2026-05-14: patched: Fixes merged into master branch
- 2026-05-19: disclosed: CVE published by Samsung TV & Appliance CNA