CVE-2026-25208 is a high severity flaw (CVSS 8.1) in Escargot, Samsung's open source JavaScript engine. An integer overflow leads to a buffer overflow. The record names one affected revision, commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, and links pull request 1554. It does not name a fixed release, so check the project.
What's affected
- Affected: Escargot at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, per the NVD record.
- Fixed in: not confirmed. The record links pull request 1554, titled "Fix minor issues". The page I read does not tie a particular change to this CVE, so verify against the project's history.
The CVSS vector reads AV:N/AC:H/PR:N/UI:N, with high impact to confidentiality, integrity and availability.. This is the one in the set rated as network reachable, with high complexity. That matters for products that run scripts received over a network.
How to check if you're exposed
Find out whether your product embeds Escargot, and which revision. Check the submodule pointer or the vendored source in your build against the commit named above. If you built from a release or a later commit, look at the project's history to see whether the change that addresses this issue is included.
git -C path/to/escargot rev-parse HEAD
What to do now
- Identify every product, device or tool that embeds Escargot, including firmware images.
- Move to a build of Escargot that includes the changes from pull request 1554, once you have confirmed they cover this issue.
- Until you have confirmed that, avoid running untrusted scripts in affected builds.
- Keep the engine on your software inventory, so a later advisory reaches you.
Why it matters
An integer overflow happens when arithmetic wraps around. If the result is then used as a size or an index, memory operations can go out of bounds. The record notes that the effect is a buffer overflow. The weakness is CWE-190 (Integer Overflow or Wraparound).
Engines run code from outside, so memory errors in them deserve attention even when the score is moderate. Scripts supplied by users, web content or third party apps all reach the same parser and interpreter.
Quick check
Why is this one rated network reachable?
The vector gives the attack vector as network, with high complexity. The record does not explain the path, so check how your product feeds scripts to the engine.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the pages I read do not report exploitation.
Sources
Last reviewed: 19 October 2026.
