CVE-2026-25205 is a high severity flaw (CVSS 7.4) in Escargot, Samsung's open source JavaScript engine. A heap based buffer overflow lets code write out of bounds. The record names one affected revision, commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, and links pull request 1554. It does not name a fixed release, so check the project.
What's affected
- Affected: Escargot at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, per the NVD record.
- Fixed in: not confirmed. The record links pull request 1554, titled "Fix minor issues". The page I read does not tie a particular change to this CVE, so verify against the project's history.
The CVSS vector reads AV:L/AC:H/PR:N/UI:N, with high impact to confidentiality, integrity and availability.. Local access and high attack complexity limit how it is reached, so risk depends on whether your product lets outsiders supply scripts.
How to check if you're exposed
Find out whether your product embeds Escargot, and which revision. Check the submodule pointer or the vendored source in your build against the commit named above. If you built from a release or a later commit, look at the project's history to see whether the change that addresses this issue is included.
git -C path/to/escargot rev-parse HEAD
What to do now
- Identify every product, device or tool that embeds Escargot, including firmware images.
- Move to a build of Escargot that includes the changes from pull request 1554, once you have confirmed they cover this issue.
- Until you have confirmed that, avoid running untrusted scripts in affected builds.
- Keep the engine on your software inventory, so a later advisory reaches you.
Why it matters
A heap overflow writes data past the end of an allocated block. That can corrupt neighbouring memory, crash the process, or in the worst case change what the program does. The weakness is CWE-122 (Heap-based Buffer Overflow).
Engines run code from outside, so memory errors in them deserve attention even when the score is moderate. Scripts supplied by users, web content or third party apps all reach the same parser and interpreter.
Quick check
What does local attack vector mean here?
The vector says the attacker needs local access. In practice that means code or input that reaches the engine on the same machine, such as a script the product runs.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the pages I read do not report exploitation.
Sources
Last reviewed: 19 October 2026.
