CVE-2026-47314 is an out of bounds write in Samsung Open Source Escargot, scored CVSS 7.8 (high) in the NVD record. The record names one affected commit, 590345cc6258317c5da850d846ce6baaf2afc2d3, and no release number. Samsung's pull request 1565, which fixes crashes and memory errors, was merged on 14 May 2026, so rebuild from a newer master.
What's affected
The NVD record says the issue affects Escargot at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 and gives no release versions. Escargot is an open source JavaScript engine from Samsung, so most users build it from source or take it through a product that embeds it.
The only reference is Samsung pull request 1565, titled Fix crash issues. It was merged into master on 14 May 2026 and covers a batch of crash and memory safety fixes in the engine. The page does not list CVE identifiers, so I cannot say which of its changes addresses CVE-2026-47314. Treat it as the likely fix path and confirm with the Escargot maintainers.
The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attacker is local and needs a user to act, for example by running a script, which is why the score is 7.8 rather than higher.
How to check if you're exposed
- If you build Escargot yourself, run
git log -1 --format=%Hin your checkout and compare the hash with the commit above. - Check whether your checkout is older than the 14 May 2026 merge.
git log --oneline --after=2026-05-13lists commits since then. An empty list means you have not picked up that work. - If Escargot arrives inside a vendor product, such as a device firmware or an app runtime, ask the vendor which Escargot revision they ship.
- Keep a note of the revision in your software bill of materials.
If you do not know whether Escargot is in your estate, a dependency scan of your repositories and images is the quickest way to find out.
What to do now
- Find every product or build that includes Escargot and record the revision.
- Update to a master revision that includes pull request 1565, and rebuild.
- Ask the maintainers or your vendor to confirm that this CVE is covered, since the pull request does not name it.
- Until updated, avoid running untrusted scripts in builds that embed the engine.
- Add Escargot to your software inventory so the next advisory is easy to match.
Why it matters
The record maps this to CWE-787, out of bounds write, where data is written outside the intended buffer. Bugs of this class in a JavaScript engine matter because the engine runs code that may not be fully trusted, and a memory error can let that code affect memory it should not touch. The record describes the effect as overflow buffers.
The CVSS vector rates the attack as local with user interaction, so the risk depends on where your Escargot build runs scripts from. The record's KEV flag is false.
Quick check
Is CVE-2026-47314 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Is there a fixed release of Escargot for CVE-2026-47314?
The record names only a commit, and the pull request I read gives a merge date, not a release tag. Check the Escargot repository for a release that postdates 14 May 2026.
Sources
Last reviewed: 19 October 2026.
