CVE-2026-25207: Samsung Open Source Escargot Out-of-Bounds Write
CVE-2026-25207 is an out-of-bounds write flaw (CWE-787) in Samsung Open Source Escargot, which the record describes as allowing buffer overflows. NVD scores it 9.8 (critical), while Samsung's own entries score it 7.4, and a pull request is referenced as a patch. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
CVE-2026-25207 is an out-of-bounds write weakness classified as CWE-787 in Samsung Open Source Escargot, a JavaScript engine project. The record describes the issue as allowing buffer overflows and identifies a specific commit of Escargot as affected. The source record was published on 2026-04-13.
Impact
NVD assigns a CVSS score of 9.8 with a network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact. Samsung's own entries score the issue 7.4. SSVC data in the record rates technical impact as total.
- Memory corruption in a script engine can potentially lead to crashes or code execution, depending on how the engine is embedded (inference).
- The exact impact in any specific Samsung product is unknown from the record.
Affected products and versions
The record lists two affected entries:
- Samsung Escargot, version 2026-03-26.
- Samsung Open Source Escargot, version 97e8115ab1110bc502b4b5e4a0c689a71520d335 (a commit identifier).
No fixed version is stated in the record. A patch reference is provided: Samsung Escargot pull request 1554. Whether a released build contains this change is unknown from the available data.
Exploitation status
The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. SSVC data marks exploitation as none and automatable as no. The EPSS entry shows a probability of 0.00188 and a percentile of 0.07991, with a date of 2026-10-23 that should be verified against the source.
Remediation and mitigation
- Identify whether any product or internal system embeds Samsung Escargot at the affected versions or commit.
- Review the patch reference and apply the vendor or project update that includes it once its release status is confirmed.
- Contact Samsung PSIRT for product-specific guidance where Escargot is bundled in a firmware or appliance.
- Limit exposure of components that process untrusted script or content, and apply least-privilege sandboxing where feasible.
Detection guidance
- Monitor for unexpected crashes, restarts or memory-safety faults in processes that run the Escargot engine.
- Review logs for abnormal behavior in components that handle untrusted input passed to the engine.
- Keep an inventory of software versions so that affected builds can be identified quickly.
Limitations of the available information
The record has no English title, no stated fixed version, no proof-of-concept information and no product-level advisory beyond the listed entries. The CVSS scores differ between NVD (9.8) and Samsung (7.4). Which Samsung products ship this engine is not stated.
Frequently asked questions
Is CVE-2026-25207 known to be actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC data marks exploitation as none.
Which versions are affected?
The record lists Samsung Escargot version 2026-03-26 and Samsung Open Source Escargot version 97e8115ab1110bc502b4b5e4a0c689a71520d335. No fixed version is stated.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.