# CVE-2026-8915: Samsung Escargot out-of-bounds write in ArrayBuffer.prototype.transfer

Source: https://junglewise.ai/threats/cve-2026-8915-samsung-escargot-out-of-bounds-write-in-arraybuffer-prototype  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-8915 · Severity: high · CVSS 8.8 · Published 2026-05-28

Samsung Escargot is an open-source JavaScript engine used in various embedded environments like smart TVs and appliances. A security flaw in how it handles memory buffers could allow an attacker to execute malicious code or crash the application when a user visits a specially crafted website or interacts with malicious web content. This poses a significant risk to device stability and the privacy of user data handled by the engine.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-8915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8915 being exploited in the wild.

**How severe is CVE-2026-8915?** High severity, with a CVSS score of 8.8, published 28 May 2026.

**Which products and versions are affected?** Samsung Escargot 36f5fb58366a67b713c02f6fd985e924fcc09e31.

**Is there a fix for CVE-2026-8915?** A patch was published on 2026-05-21: Pull request 1579 submitted to address the size checking issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8915 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8915?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in Samsung's Escargot JavaScript engine within the 'ArrayBuffer.prototype.transfer' implementation. The root cause is a lack of proper size validation when resizing or transferring buffers, specifically failing to check 'newByteLength' against the 'maxByteLength' of resizable ArrayBuffers. An attacker can exploit this by providing a malicious index or length value, leading to a buffer overflow. This is reachable via network-delivered JavaScript (e.g., a malicious webpage) and requires minimal user interaction. A fix involving enhanced size checking in 'src/builtins/BuiltinArrayBuffer.cpp' has been identified in the project's pull requests.

## Affected products

- Samsung Escargot 36f5fb58366a67b713c02f6fd985e924fcc09e31

## Timeline

- 2026-05-21: patched: Pull request 1579 submitted to address the size checking issue.
- 2026-05-27: advisory: CVE-2026-8915 published by Samsung TV & Appliance.

## References

- [https://github.com/Samsung/escargot/pull/1579](https://github.com/Samsung/escargot/pull/1579)

## Related threats

- [Samsung Escargot use-after-free in string buffer access](https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot)
- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot integer overflow in bytecode cache](https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot out-of-bounds read and reachable assertion](https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion)