Executive brief
Samsung Escargot is an open-source JavaScript engine used in embedded and server applications. A numeric truncation flaw allows an attacker to supply malicious JavaScript that corrupts memory and crashes the host process, potentially enabling code execution or service disruption in applications that execute untrusted scripts.
Technical details
The vulnerability is an out-of-bounds write caused by numeric truncation in Escargot's class initialization handling. When processing a class definition with an instance initialization entry count exceeding UINT16_MAX (65535), the count is truncated to a 16-bit value, causing a mismatch between allocated and written memory. An attacker can trigger this by supplying a crafted class definition to the JavaScript engine. The flaw allows memory corruption and host process crash; potential for arbitrary code execution depends on the specific memory layout and exploitation technique. The issue was fixed in commit 5dc93606abd42b859045add05d704a038e197359.
Affected products
- Samsung Escargot prior to commit 5dc93606abd42b859045add05d704a038e197359
Timeline
- 2026-09-07: disclosed
- 2026-09-04: patched: Fix merged in PR #1660