CVE Intelligence
Analysis AI-assisted

CVE-2026-25206: Samsung Open Source Escargot Out-of-Bounds Read Information Exposure

CVE-2026-25206 is an out-of-bounds read vulnerability (CWE-125) in Samsung Open Source Escargot that the record says allows resource leak exposure. NVD scores it 9.1 (critical), while Samsung PSIRT and the Samsung CNA score it 6.7. The record shows no confirmed exploitation, and a patch reference is listed without a stated fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25206 is classified as an out-of-bounds read (CWE-125) in Samsung Open Source Escargot. The published description states that the flaw allows resource leak exposure and identifies the affected code by a commit identifier.

Impact

  • The description states the issue allows resource leak exposure.
  • NVD assigns a base score of 9.1 (critical) with a vector that lists high confidentiality impact, no integrity impact and high availability impact.
  • Samsung PSIRT and the Samsung CNA each assign 6.7, so the scoring sources disagree.
  • The record does not describe the exact data exposed or the conditions needed to trigger the flaw.

Affected products and versions

  • Samsung Escargot: version 2026-03-26
  • Samsung Open Source Escargot: version 97e8115ab1110bc502b4b5e4a0c689a71520d335
  • The record does not list a fixed version. It does list a patch-type reference, GitHub pull request 1554, which should be reviewed to confirm whether it addresses the affected builds.

Exploitation status

  • The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC fields in the record report exploitation as none and automatable as no. The EPSS probability is 0.00184.

Remediation and mitigation

  • Identify whether your environment embeds Samsung Open Source Escargot and which build it uses.
  • Review the upstream pull request and check it against your build to see whether the change applies.
  • Update to a build that includes the upstream change, and confirm the result with the maintainer or vendor, since the record gives no fixed version.
  • Where updating is not immediately possible, reduce exposure of the component to untrusted input as a defensive measure, without relying on any specific bypass.

Detection guidance

  • Monitor for crashes, memory access errors or unexpected process terminations in applications that embed the engine.
  • Review logs for unusual behavior when the engine processes external content.
  • Track vendor advisories for updated information.

Limitations of the available information

  • The record gives no fixed version and no explicit remediation statement.
  • The scoring sources disagree (9.1 versus 6.7).
  • The record does not explain the trigger conditions or the exact exposed resources.
  • The EPSS date in the record is later than the publication date, so its timing should be checked against the current data source.

Frequently asked questions

What is CVE-2026-25206?

It is an out-of-bounds read vulnerability (CWE-125) in Samsung Open Source Escargot that the record says allows resource leak exposure.

Is this vulnerability known to be exploited?

It is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists version 2026-03-26 of Samsung Escargot and the commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 of Samsung Open Source Escargot. It does not list a fixed version.

What should I do now?

Check whether you use the affected component, review the upstream pull request 1554, and apply an update that includes the change once confirmed by the maintainer or vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.