CVE-2026-25205: Samsung Open Source Escargot heap-based buffer overflow
A heap-based buffer overflow in Samsung Open Source Escargot allows an out-of-bounds write, tracked as CVE-2026-25205. NVD scores it 9.8 (critical), while Samsung PSIRT and the CNA score it 7.4. The record lists no fixed version, and the issue is not listed in CISA KEV.
Overview
The record describes a heap-based buffer overflow in Samsung Open Source Escargot that allows an out-of-bounds write. The affected code is identified by a commit hash of the Escargot project. The only reference in the record is the upstream issue tracking pull request.
Impact
An out-of-bounds write into heap memory can corrupt program state. The record's CWE is CWE-122 (Heap-based Buffer Overflow). NVD assigns CVSS 3.1 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network attack vector, no privileges and no user interaction. Samsung PSIRT and the CNA assign 7.4 under CVSS 3.1, so the sources disagree on severity. The SSVC entry in the record rates technical impact as total.
Affected products and versions
The record lists two entries: Samsung Escargot with version 2026-03-26, and Samsung Open Source Escargot identified by commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. The record does not list any fixed version, and it does not state whether earlier builds are affected.
Exploitation status
The record shows that CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none and automatable is no. The EPSS probability is 0.00187 with a percentile of 0.07897, as recorded.
Remediation and mitigation
No patch or fixed version is listed in the record, so the absence of a fix should be treated as unknown rather than as the absence of a fix. Teams that embed or build Escargot should identify whether their builds match the listed commit or the 2026-03-26 release. They should monitor the upstream repository and Samsung PSIRT for updates, and apply vendor fixes when published. Where feasible, limit exposure of the engine to untrusted input until a fix is confirmed.
Detection guidance
The sources do not provide signatures or indicators of compromise. At a high level, monitor applications that embed Escargot for unexpected crashes, abnormal termination and memory-corruption symptoms, and keep logs that allow such events to be reviewed.
Limitations of the available information
The record provides no fixed version, no patch, no technical details on the vulnerable function, and no proof of exploitation status beyond KEV absence. The severity scores differ between NVD and Samsung. The EPSS date in the record is later than the publication date, so the EPSS values should be read with that in mind.
Frequently asked questions
Is CVE-2026-25205 being actively exploited?
The record shows that CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none.
Which versions are affected?
The record lists Samsung Escargot version 2026-03-26 and Samsung Open Source Escargot identified by commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. No fixed version is listed.
Why do the severity scores differ?
NVD assigns CVSS 3.1 9.8, while Samsung PSIRT and the CNA assign 7.4 under the same CVSS version. The record does not explain the difference.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.