CVE-2026-25209 is a medium severity flaw (CVSS 6.5) in Escargot, Samsung's open source JavaScript engine. An out of bounds read can expose memory and cause a crash. The record names one affected revision, commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, and links pull request 1554. It does not name a fixed release, so check the project.
What's affected
- Affected: Escargot at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335, per the NVD record.
- Fixed in: not confirmed. The record links pull request 1554, titled "Fix minor issues". The page I read does not tie a particular change to this CVE, so verify against the project's history.
The CVSS vector reads AV:N/AC:H/PR:N/UI:N, with high confidentiality impact and low availability impact.. It is rated network reachable with high complexity.
How to check if you're exposed
Find out whether your product embeds Escargot, and which revision. Check the submodule pointer or the vendored source in your build against the commit named above. If you built from a release or a later commit, look at the project's history to see whether the change that addresses this issue is included.
git -C path/to/escargot rev-parse HEAD
What to do now
- Identify every product, device or tool that embeds Escargot, including firmware images.
- Move to a build of Escargot that includes the changes from pull request 1554, once you have confirmed they cover this issue.
- Until you have confirmed that, avoid running untrusted scripts in affected builds.
- Keep the engine on your software inventory, so a later advisory reaches you.
Why it matters
An out of bounds read returns data from beyond the intended buffer. The record labels the result as resource leak exposure. It can leak memory contents or crash the engine. The weakness is CWE-125 (Out-of-bounds Read).
Engines run code from outside, so memory errors in them deserve attention even when the score is moderate. Scripts supplied by users, web content or third party apps all reach the same parser and interpreter.
Quick check
How is this different from CVE-2026-25206?
Both are out of bounds reads in the same revision. This one has a network attack vector and a lower availability impact, while CVE-2026-25206 is local.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the pages I read do not report exploitation.
Sources
Last reviewed: 19 October 2026.
