CVE-2026-25206
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An out-of-bounds read vulnerability in Samsung's open source Escargot library allows resource leak exposure. The issue affects the specific Escargot revision 97e8115ab1110bc502b4b5e4a0c689a71520d335.
Risk Assessment
The vulnerability may lead to disclosure of sensitive memory contents or destabilize applications using Escargot. Organizations relying on this library are exposed to data leakage.
Recommendation
Update Escargot to a version containing the fix (newer than the referenced commit) or restrict processing of untrusted input. Monitor the project's security advisories.
Other vulnerabilities in Escargot
See all- CVE-2026-118435Medium
An out-of-bounds write vulnerability in Samsung Open Source escargot allows buffer manipulation. This may lead to memory corruption or unexpected code execution.
- CVE-2026-92259Medium
Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.
- CVE-2026-86315Medium
An out-of-bounds write caused by numeric truncation in Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. Affects version 5dc93606abd42b859045add05d704a038e197359.
- CVE-2026-58307Medium
An out-of-bounds read and reachable assertion vulnerability in Samsung Open Source Escargot allows overread buffers and input data manipulation.
- CVE-2026-58306Medium
A heap-based buffer overflow vulnerability has been discovered in Samsung Open Source Escargot. The issue affects versions prior to commit ef525f337fafddecde77a3c426212a84bb20cb98.
- CVE-2026-58305Medium
A type confusion vulnerability in Samsung's Escargot JavaScript engine allows pointer manipulation. The issue affects versions prior to commit 779f6bedf58f334dec64b0a51ebb724b4708b84a.
- CVE-2026-58304Medium
An out-of-bounds read and write vulnerability has been discovered in Samsung Open Source Escargot, leading to buffer overflows. The issue affects versions prior to commit 779f6bedf58f334dec64b0a51ebb724b4708b84a.
- CVE-2026-58303Medium
A stack-based buffer overflow vulnerability has been discovered in Samsung's Escargot JavaScript engine. The issue affects versions prior to commit b30b63fc63b403907d8137da1c65aaa4521fe74e.
- CVE-2026-14160Medium
A Time-of-check time-of-use (TOCTOU) race condition vulnerability has been discovered in Samsung Open Source Escargot. This flaw allows leveraging race conditions to compromise data integrity.
- CVE-2026-47317Medium
Samsung Open Source Escargot is vulnerable to uncontrolled recursion leading to excessive memory allocation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
Original NVD description (English source)
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS