Executive brief
Samsung Escargot is an open-source JavaScript engine often used in embedded environments like smart TVs and appliances. A vulnerability in how the engine handles specific code structures, such as 'using' declarations and loop labels, can cause the application to crash or behave unpredictably. This could allow an attacker to disrupt service or potentially manipulate data if they can convince a user to run a malicious script.
Technical details
Samsung Escargot contains multiple flaws including an out-of-bounds read (CWE-125) and reachable assertions (CWE-617). One root cause involves the 'using' declaration in switch cases where the engine prematurely releases registers, allowing subsequent statements to clobber disposable resource records; this leads to a segmentation fault in 'finalizeDisposable'. Another issue involves 'continue' statements targeting labeled 'for-of' loops, which incorrectly trigger iterator cleanup and leave empty values in result registers. These vulnerabilities are reachable via local execution of specially crafted JavaScript. A fix has been merged in commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.
Affected products
- Samsung Open Source Escargot before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c
Timeline
- 2026-06-16: other: Fix pull request submitted
- 2026-06-17: patched: Fix merged into master branch
- 2026-07-09: advisory: CVE published