CVE-2026-86315 PUBLISHED

Assigner: samsung.tv_appliance
Reserved: 07.09.2026 Published: 07.09.2026 Updated: 07.09.2026

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.

This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.2

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Samsung Opensource
Product	Escargot
Versions	Default: unaffected Version 5dc93606abd42b859045add05d704a038e197359 is affected

Credits

p4p3r of 싸이버원 finder

References

https://github.com/Samsung/escargot/pull/1660

Problem Types

CWE-197 Numeric truncation error CWE

Impacts

CAPEC-100 Overflow Buffers