CVE-2026-58307: Escargot Out-of-Bounds Read & Assertion Failure

Technical summary

This vulnerability combines an out-of-bounds read (CWE-125) with a reachable assertion (CWE-617) in Escargot, Samsung's open-source JavaScript engine. The flaw allows an attacker to craft input that exceeds buffer boundaries during processing, leading to memory disclosure and/or assertion violations. The vector indicates local attack surface with no privilege escalation needed, but user interaction is required to trigger the vulnerability. The issue was patched in commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

Business impact

Organizations embedding Escargot in applications face denial-of-service risk through user-triggered crashes. Confidentiality impact is limited, but integrity is at risk if the out-of-bounds read exposes sensitive values that influence subsequent program behavior. The requirement for user interaction lowers the attack surface for mass exploitation, but targeted campaigns exploiting this flaw against specific users or customers remain feasible.

Affected systems

Samsung Escargot JavaScript engine versions before commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c are vulnerable. Vendors, OEMs, and developers who integrate Escargot into products (including embedded systems, browsers, or runtime environments) should audit their dependency versions and update accordingly. The vulnerability is not currently tracked in any public KEV or active exploitation databases.

Exploitability

Exploitation requires local file system access or ability to deliver malicious input to an Escargot-based application, combined with user interaction. There is no network vector; however, if the affected application processes remote content (e.g., JavaScript files fetched from the internet), the attack could be semi-remote. The assertion failure provides a clear crash signal to attackers, making this vulnerability straightforward to trigger once the malicious input is crafted.

Remediation

Patch Escargot to the fixed commit or any release incorporating 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c. Review dependencies in your software supply chain and prioritize updates for any products embedding this engine. If patching is delayed, isolate or disable Escargot-dependent features handling untrusted input.

Patch guidance

Update to a version of Escargot that includes commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c or later. Verify with Samsung's advisory and your vendor's release notes to confirm the fix is included. If you maintain a fork or downstream build, cherry-pick or merge this commit and rebuild affected applications.

Detection guidance

Monitor for Escargot process crashes or assertion failures in logs, particularly when correlated with unusual input patterns or file access. If you have debugging symbols, inspect core dumps for failures originating in Escargot's buffer handling routines. Network-based detection is limited; focus on endpoint telemetry capturing application crashes and their triggering events.

Why prioritize this

Although this is a medium-severity vulnerability, organizations should prioritize it if they rely on Escargot in user-facing or automated processing pipelines. The crash availability impact and the relative ease of triggering the flaw justify prompt remediation. However, lack of remote network attack vector and KEV designation lower urgency compared to high-impact remote vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects the combination of low attack complexity, local-only vector, required user interaction, no privilege escalation, and mixed impact (integrity degraded, availability high, confidentiality none). The score appropriately penalizes availability while acknowledging the constraint that exploitation requires user engagement and local access.

Frequently asked questions