Executive brief
Samsung Escargot is an open-source JavaScript engine often used in smart TVs and appliances. A security flaw in how the engine processes certain code could allow an attacker to crash the application or potentially execute unauthorized commands. This could lead to service disruptions or unauthorized changes to the device's behavior if a user is tricked into running a malicious script.
Technical details
A heap-based buffer overflow (CWE-122) exists in the `Escargot::Interpreter::interpret` function within `src/interpreter/ByteCodeInterpreter.cpp`. The vulnerability is triggered by an edge case in `blockOperation` where a missing range check on the `programCount` allows a read/write beyond the allocated heap buffer. An attacker can exploit this by providing a specially crafted JavaScript file (e.g., using nested functions and specific control flow structures like `with` and `continue` labels) that requires user interaction to execute. The issue was resolved by adding a `programCount` range check in commit `ef525f337fafddecde77a3c426212a84bb20cb98`.
Affected products
- Samsung Escargot before ef525f337fafddecde77a3c426212a84bb20cb98
Timeline
- 2026-06-15: patched: Pull request with fix merged into master branch.
- 2026-07-09: advisory: CVE published by Samsung TV & Appliance.