CVE-2026-86315: Medium severity Samsung Open Source Escargot vulnerability
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MAX.
This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Linux x86-64 deployments of Samsung Open Source Escargot at commit 5dc93606abd42b859045add05d704a038e197359 are affected when they execute attacker-supplied JavaScript.
What does an attacker need to exploit it?
The attacker must be able to supply JavaScript that the affected Escargot instance will execute. Exploitation uses a crafted class definition with more instance initialization entries than UINT16_MAX.
What is the practical impact?
The numeric truncation causes an out-of-bounds native-memory write. An attacker can corrupt native memory and crash the host process.
How can I determine whether an environment may be affected?
Check whether the deployment runs Escargot on Linux x86-64 and whether untrusted parties can provide JavaScript for execution. Also compare the Escargot source revision in use against commit 5dc93606abd42b859045add05d704a038e197359.