Quick answers
- Is CVE-2026-86315 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86315 being exploited in the wild.
- How severe is CVE-2026-86315?
- Medium severity, with a CVSS score of 6.2, published 7 September 2026.
- Which products and versions are affected?
- Samsung Escargot prior to commit 5dc93606abd42b859045add05d704a038e197359.
- Is there a fix for CVE-2026-86315?
- A patch was published on 2026-09-04: Fix merged in PR #1660 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86315 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-86315?
- Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds write caused by numeric truncation in Escargot's class initialization handling. When processing a class definition with an instance initialization entry count exceeding UINT16_MAX (65535), the count is truncated to a 16-bit value, causing a mismatch between allocated and written memory. An attacker can trigger this by supplying a crafted class definition to the JavaScript engine. The flaw allows memory corruption and host process crash; potential for arbitrary code execution depends on the specific memory layout and exploitation technique. The issue was fixed in commit 5dc93606abd42b859045add05d704a038e197359.
Affected products
- Samsung Escargot prior to commit 5dc93606abd42b859045add05d704a038e197359
Timeline
- 2026-09-07: disclosed
- 2026-09-04: patched: Fix merged in PR #1660