CVE-2026-92259: Integer Overflow
Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file.
This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when an attacker has write access to Escargot's bytecode-cache directory. The attack requires local access and low privileges, according to the supplied CVSS vector.
What does an attacker need to exploit it?
The attacker needs to place or modify a crafted cache file in the bytecode-cache directory. Processing that file can trigger an integer wraparound leading to a heap-based buffer overflow and denial of service.
What can be done if updating is not immediately possible?
Restrict write access to the bytecode-cache directory to trusted accounts and processes. Prevent untrusted users from creating or modifying cache files in that location.
How can I determine whether my deployment is affected?
Check whether the Escargot source revision in use is ac94df78493ee6fede286620d94f724e46b4d238 and whether untrusted or low-privileged users can write to its bytecode-cache directory.