# CVE-2026-58307: Samsung Escargot out-of-bounds read and reachable assertion

Source: https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-58307 · Severity: medium · CVSS 6.1 · Published 2026-07-09

Samsung Escargot is an open-source JavaScript engine often used in embedded environments like smart TVs and appliances. A vulnerability in how the engine handles specific code structures, such as 'using' declarations and loop labels, can cause the application to crash or behave unpredictably. This could allow an attacker to disrupt service or potentially manipulate data if they can convince a user to run a malicious script.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-58307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58307 being exploited in the wild.

**How severe is CVE-2026-58307?** Medium severity, with a CVSS score of 6.1, published 9 July 2026.

**Which products and versions are affected?** Samsung Escargot before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

**Is there a fix for CVE-2026-58307?** A patch was published on 2026-06-17: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58307 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-58307?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Samsung Escargot contains multiple flaws including an out-of-bounds read (CWE-125) and reachable assertions (CWE-617). One root cause involves the 'using' declaration in switch cases where the engine prematurely releases registers, allowing subsequent statements to clobber disposable resource records; this leads to a segmentation fault in 'finalizeDisposable'. Another issue involves 'continue' statements targeting labeled 'for-of' loops, which incorrectly trigger iterator cleanup and leave empty values in result registers. These vulnerabilities are reachable via local execution of specially crafted JavaScript. A fix has been merged in commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

## Affected products

- Samsung Open Source Escargot before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c

## Timeline

- 2026-06-16: other: Fix pull request submitted
- 2026-06-17: patched: Fix merged into master branch
- 2026-07-09: advisory: CVE published

## References

- [https://github.com/Samsung/escargot/issues/1577](https://github.com/Samsung/escargot/issues/1577)
- [https://github.com/Samsung/escargot/pull/1586](https://github.com/Samsung/escargot/pull/1586)

## Related threats

- [Samsung Escargot use-after-free in string buffer access](https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot)
- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot integer overflow in bytecode cache](https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot heap buffer overflow in ByteCodeInterpreter](https://junglewise.ai/threats/cve-2026-58306-samsung-escargot-heap-buffer-overflow-in-bytecodeinterpreter)