# CVE-2026-92259: Samsung Escargot integer overflow in bytecode cache

Source: https://junglewise.ai/threats/cve-2026-92259-samsung-escargot-integer-overflow-in-bytecode-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92259 · Severity: medium · CVSS 5.5 · Published 2026-09-15

Samsung Escargot is an open-source JavaScript engine used in embedded and mobile environments. An integer overflow vulnerability in its bytecode caching mechanism allows attackers with write access to the cache directory to trigger a heap-based buffer overflow, potentially causing the application to crash and denying service to legitimate users.

Technologies: [Samsung Escargot](https://junglewise.ai/threats/technologies/escargot). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-92259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92259 being exploited in the wild.

**How severe is CVE-2026-92259?** Medium severity, with a CVSS score of 5.5, published 15 September 2026.

**Which products and versions are affected?** Samsung Escargot commit ac94df78493ee6fede286620d94f724e46b4d238 and earlier.

**Is there a fix for CVE-2026-92259?** A patch was published on 2026-08-24: Fix merged in pull request #1650 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92259 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-92259?** Check whether you run Samsung Escargot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow or wraparound in Samsung Escargot's bytecode cache handling that leads to a heap-based buffer overflow. The attack requires write access to the bytecode-cache directory on the target system. When a crafted cache file is processed, the integer overflow occurs during cache validation or size calculation, causing a buffer overflow that results in denial of service (crash). The fix is available in commit ac94df78493ee6fede286620d94f724e46b4d238 and related patches merged in pull request #1650.

## Affected products

- Samsung Escargot commit ac94df78493ee6fede286620d94f724e46b4d238 and earlier

## Timeline

- 2026-09-15: disclosed
- 2026-08-24: patched: Fix merged in pull request #1650

## References

- [https://github.com/Samsung/escargot/pull/1650](https://github.com/Samsung/escargot/pull/1650)

## Related threats

- [Samsung Escargot use-after-free in string buffer access](https://junglewise.ai/threats/cve-2026-124684-use-after-free-vulnerability-in-samsung-open-source-escargot)
- [Samsung escargot out-of-bounds write in code cache](https://junglewise.ai/threats/cve-2026-118435-out-of-bounds-write-vulnerability-in-samsung-open-source)
- [Samsung Escargot out-of-bounds write in class initialization](https://junglewise.ai/threats/cve-2026-86315-samsung-escargot-out-of-bounds-write-in-class-initialization)
- [Samsung Escargot out-of-bounds read and reachable assertion](https://junglewise.ai/threats/cve-2026-58307-samsung-escargot-out-of-bounds-read-and-reachable-assertion)
- [Samsung Escargot heap buffer overflow in ByteCodeInterpreter](https://junglewise.ai/threats/cve-2026-58306-samsung-escargot-heap-buffer-overflow-in-bytecodeinterpreter)