CVE-2026-8915
Out-of-Bounds Write in Samsung Open Source Escargot
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Samsung TV & Appliance
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samsung | escargot | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8915 is an out-of-bounds write vulnerability in the Samsung Open Source Escargot JavaScript engine. It arises from a race condition (Time-of-Check to Time-of-Use) in the handling of the toIndex valueOf callback within the ArrayBuffer.prototype.transfer method. This flaw could allow the engine to write outside the bounds of allocated memory buffers, potentially leading to memory corruption.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing an attacker to execute arbitrary code, cause a denial of service by crashing the application, or corrupt memory leading to unpredictable behavior. Because the vulnerability affects memory safety with high confidentiality, integrity, and availability impacts (CVSS 8.8), it poses a significant security risk if exploited.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Escargot JavaScript engine to the version that includes the fix merged on May 21, 2026.
The fix adds size checking to the ArrayBuffer.prototype.transfer method to prevent out-of-bounds writes caused by a TOCTOU race condition.
Applying this update will prevent invalid memory access and improve performance and readability by removing redundant checks.