CVE-2026-8915: Samsung Escargot out-of-bounds write in ArrayBuffer.prototype.transfer

CVE-2026-8915 · Severity: high · CVSS 8.8 · Published 2026-05-28

Samsung Escargot is an open-source JavaScript engine used in various embedded environments like smart TVs and appliances. A security flaw in how it handles memory buffers could allow an attacker to execute malicious code or crash the application when a user visits a specially crafted website or interacts with malicious web content. This poses a significant risk to device stability and the privacy of user data handled by the engine.

Technologies: Samsung Escargot. Vendors: Samsung.

Quick answers

Is CVE-2026-8915 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8915 being exploited in the wild.
How severe is CVE-2026-8915?
High severity, with a CVSS score of 8.8, published 28 May 2026.
Which products and versions are affected?
Samsung Escargot 36f5fb58366a67b713c02f6fd985e924fcc09e31.
Is there a fix for CVE-2026-8915?
A patch was published on 2026-05-21: Pull request 1579 submitted to address the size checking issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8915 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8915?
Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in Samsung's Escargot JavaScript engine within the 'ArrayBuffer.prototype.transfer' implementation. The root cause is a lack of proper size validation when resizing or transferring buffers, specifically failing to check 'newByteLength' against the 'maxByteLength' of resizable ArrayBuffers. An attacker can exploit this by providing a malicious index or length value, leading to a buffer overflow. This is reachable via network-delivered JavaScript (e.g., a malicious webpage) and requires minimal user interaction. A fix involving enhanced size checking in 'src/builtins/BuiltinArrayBuffer.cpp' has been identified in the project's pull requests.

Affected products

  • Samsung Escargot 36f5fb58366a67b713c02f6fd985e924fcc09e31

Timeline

  • 2026-05-21: patched: Pull request 1579 submitted to address the size checking issue.
  • 2026-05-27: advisory: CVE-2026-8915 published by Samsung TV & Appliance.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.