Is CVE-2026-58306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58306 being exploited in the wild.

How severe is CVE-2026-58306?

Medium severity, with a CVSS score of 6.1, published 9 July 2026.

Which products and versions are affected?

Samsung Escargot before ef525f337fafddecde77a3c426212a84bb20cb98.

Is there a fix for CVE-2026-58306?

A patch was published on 2026-06-15: Pull request with fix merged into master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58306 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-58306?

Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58306: Samsung Escargot heap buffer overflow in ByteCodeInterpreter

CVE-2026-58306 · Severity: medium · CVSS 6.1 · Published 2026-07-09

Samsung Escargot is an open-source JavaScript engine often used in smart TVs and appliances. A security flaw in how the engine processes certain code could allow an attacker to crash the application or potentially execute unauthorized commands. This could lead to service disruptions or unauthorized changes to the device's behavior if a user is tricked into running a malicious script.

Technologies: Samsung Escargot. Vendors: Samsung.

Quick answers

Is CVE-2026-58306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58306 being exploited in the wild.
How severe is CVE-2026-58306?: Medium severity, with a CVSS score of 6.1, published 9 July 2026.
Which products and versions are affected?: Samsung Escargot before ef525f337fafddecde77a3c426212a84bb20cb98.
Is there a fix for CVE-2026-58306?: A patch was published on 2026-06-15: Pull request with fix merged into master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58306 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-58306?: Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the `Escargot::Interpreter::interpret` function within `src/interpreter/ByteCodeInterpreter.cpp`. The vulnerability is triggered by an edge case in `blockOperation` where a missing range check on the `programCount` allows a read/write beyond the allocated heap buffer. An attacker can exploit this by providing a specially crafted JavaScript file (e.g., using nested functions and specific control flow structures like `with` and `continue` labels) that requires user interaction to execute. The issue was resolved by adding a `programCount` range check in commit `ef525f337fafddecde77a3c426212a84bb20cb98`.

Affected products

Samsung Escargot before ef525f337fafddecde77a3c426212a84bb20cb98

Timeline

2026-06-15: patched: Pull request with fix merged into master branch.
2026-07-09: advisory: CVE published by Samsung TV & Appliance.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.