CVE-2026-14160: TOCTOU Race Condition in Samsung Escargot JavaScript Engine

Technical summary

CVE-2026-14160 is a time-of-check time-of-use (TOCTOU) race condition in Samsung Open Source Escargot (commit bab3a5797557014ce3c2e28419a6310cfba90d0d). The vulnerability arises from a gap between when Escargot validates access to a resource and when it actually uses that resource. An attacker with local system access can modify the target resource's properties, ownership, or permissions during this window, potentially circumventing intended access controls. The CVSS 3.1 score of 5.9 reflects local attack vector requirements (AV:L), low attack complexity (AC:L), and low privilege prerequisites, with potential impact across confidentiality, integrity, and availability.

Business impact

Organizations deploying Escargot in environments where untrusted local users have system access face elevated privilege escalation and data integrity risks. While the medium severity score limits this to lower-priority remediation schedules, successful exploitation could allow local attackers to read sensitive data, modify application state, or cause denial of service. Development teams relying on Escargot for embedded or containerized JavaScript execution should assess whether their threat model includes local attacker scenarios.

Affected systems

Samsung Open Source Escargot at commit bab3a5797557014ce3c2e28419a6310cfba90d0d is confirmed vulnerable. The vulnerability affects Escargot deployments used as a JavaScript runtime in applications and systems. Verify your specific Escargot version against the commit hash provided in the official Samsung advisory to confirm exposure.

Exploitability

The vulnerability requires local access to the affected system, eliminating remote exploitation paths. No authentication or user interaction is needed once local access is achieved, making it practical for attackers with even basic system presence. However, the requirement for local system access significantly reduces the threat surface in properly segmented or physically controlled environments. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no active in-the-wild exploitation has been publicly disclosed as of the publication date.

Remediation

Apply the security patch provided by Samsung for Escargot. Verify the patched commit against the vendor advisory to confirm you are deploying a fixed version beyond bab3a5797557014ce3c2e28419a6310cfba90d0d. For systems unable to patch immediately, restrict local system access through privilege separation, user account isolation, and principle of least privilege—particularly for untrusted or external user accounts.

Patch guidance

Consult the Samsung Open Source Escargot project advisory for the specific patch version and commit hash that resolves CVE-2026-14160. Upgrade to the recommended version as soon as it becomes available. Test patches in a non-production environment first, especially if Escargot is tightly integrated with critical application logic. Maintain an inventory of Escargot deployments across your infrastructure to ensure comprehensive coverage.

Detection guidance

Monitor system logs for unusual file or permission modifications during periods when Escargot is executing, particularly in multi-user or containerized environments. File integrity monitoring tools can detect unexpected changes to resources accessed by Escargot processes. Review access logs for suspicious local process interactions with shared system resources. If your organization runs Escargot in isolated containers or with strict privilege boundaries, the practical exploitation window is narrowed, reducing alert fatigue.

Why prioritize this

Classify this as medium priority due to the medium CVSS score and the local-access-only attack requirement. Organizations with strong local access controls, single-tenant systems, or isolated execution environments can defer patching to a standard maintenance window. Multi-tenant systems, development workstations, or shared hosting environments should prioritize patching sooner, as they are more exposed to local attacker scenarios.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects a low attack complexity attack that requires local system access (AV:L), no elevated privileges (PR:N), and no user interaction (UI:N). The impact is partial across confidentiality, integrity, and availability (C:L/I:L/A:L), meaning the vulnerability can leak information, allow unauthorized modification, or trigger service disruptions, but not catastrophic compromise. The local-only attack vector prevents a higher score despite the broad impact categories.

Frequently asked questions