Executive brief
Samsung Escargot is an open-source JavaScript engine used in embedded and mobile environments. An integer overflow vulnerability in its bytecode caching mechanism allows attackers with write access to the cache directory to trigger a heap-based buffer overflow, potentially causing the application to crash and denying service to legitimate users.
Technical details
The vulnerability is an integer overflow or wraparound in Samsung Escargot's bytecode cache handling that leads to a heap-based buffer overflow. The attack requires write access to the bytecode-cache directory on the target system. When a crafted cache file is processed, the integer overflow occurs during cache validation or size calculation, causing a buffer overflow that results in denial of service (crash). The fix is available in commit ac94df78493ee6fede286620d94f724e46b4d238 and related patches merged in pull request #1650.
Affected products
- Samsung Escargot commit ac94df78493ee6fede286620d94f724e46b4d238 and earlier
Timeline
- 2026-09-15: disclosed
- 2026-08-24: patched: Fix merged in pull request #1650