CVE-2026-25207 is a high severity flaw (CVSS 7.4) in Escargot, Samsung's open source JavaScript engine. An out of bounds write overflows a buffer. The record names one affected revision, commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, and links pull request 1554. It does not name a fixed release, so check the project.
What's affected
- Affected: Escargot at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, per the NVD record.
- Fixed in: not confirmed. The record links pull request 1554, titled "Fix minor issues". The page I read does not tie a particular change to this CVE, so verify against the project's history.
The CVSS vector reads AV:L/AC:H/PR:N/UI:N, with high impact to confidentiality, integrity and availability.. Local access and high attack complexity limit how it is reached.
How to check if you're exposed
Find out whether your product embeds Escargot, and which revision. Check the submodule pointer or the vendored source in your build against the commit named above. If you built from a release or a later commit, look at the project's history to see whether the change that addresses this issue is included.
git -C path/to/escargot rev-parse HEAD
What to do now
- Identify every product, device or tool that embeds Escargot, including firmware images.
- Move to a build of Escargot that includes the changes from pull request 1554, once you have confirmed they cover this issue.
- Until you have confirmed that, avoid running untrusted scripts in affected builds.
- Keep the engine on your software inventory, so a later advisory reaches you.
Why it matters
An out of bounds write stores data outside the memory it was meant for. It is among the most serious memory errors, because it can corrupt state the program relies on. The weakness is CWE-787 (Out-of-bounds Write).
Engines run code from outside, so memory errors in them deserve attention even when the score is moderate. Scripts supplied by users, web content or third party apps all reach the same parser and interpreter.
Quick check
Is an out of bounds write worse than a read?
Usually, yes. A write can change program state, while a read mostly exposes data or crashes. The record rates integrity impact as high for this one.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the pages I read do not report exploitation.
Sources
Last reviewed: 19 October 2026.
