CVE-2026-40446 is a type confusion flaw in Samsung Open Source Escargot, a JavaScript engine, scored CVSS 6.9. The record names a single commit as affected and cites a pull request as the fix. Escargot has no fixed release named in the sources, so rebuild from a commit that includes the change.
What's affected
From the NVD record:
- Affected: Escargot at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335
- Fix reference: pull request 1554 in the Samsung/escargot repository
The record gives the vulnerable state as one commit and not a version range, and the pull request is titled as a set of minor fixes. I could not read detail beyond that, so I will not describe how the type confusion is reached or name a fixed release.
How to check if you're exposed
If you embed Escargot, find the commit your build uses. For a git submodule:
git submodule status | grep -i escargot
For a vendored copy, check the recorded commit or the date of the copy. Compare it with the commit above and with the pull request's merge. If you build from an older snapshot, you should update.
What to do now
- Find out whether any of your products embed Escargot.
- Update to a commit that includes the changes from pull request 1554.
- Rebuild and re-test products that bundle the engine.
- Restrict the engine to scripts you trust until you have updated.
Why it matters
The weakness is CWE-843, access of a resource using an incompatible type. When an engine treats a value as one type while it is another, memory accesses can go to unexpected places, which can be used for pointer manipulation as the record puts it.
The CVSS vector is local with high complexity, so the score is medium. Engines that run scripts from outside sources deserve faster attention than ones that only run your own. The record does not flag exploitation in the wild.
Quick check
Is there a numbered release with the fix?
The sources I checked do not name one. Check the project releases and use a commit that includes pull request 1554.
Sources
Last reviewed: 19 October 2026.
