CVE-2026-8915: Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers

Synopsis

An out-of-bounds write vulnerability exists in Samsung Open Source Escargot, a lightweight JavaScript engine. The flaw is reachable over the network with no authentication required, but an attacker must convince a victim to take some action (such as visiting a crafted page or triggering script execution) to exploit it. Successful exploitation gives an attacker full read and write access to affected memory and can crash the service, enabling potential remote code execution. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted request or payload to the exposed endpoint to trigger the out-of-bounds write.

• AuthenticationNot required

  No credentials or account are needed; the attacker can reach the vulnerable code path as an unauthenticated party.

• Victim interactionRequired

  A victim must take an action, such as opening a crafted script or visiting a page that triggers execution in the Escargot engine, for the write to be reached.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker writes attacker-controlled data outside the intended buffer boundary, which can corrupt adjacent memory structures.
• High confidentiality impact means the attacker reads arbitrary memory contents, including secrets, tokens, or application data held in the process.
• High integrity impact means the attacker modifies persisted or in-flight data and can redirect program control flow, enabling remote code execution within the Escargot process.
• High availability impact means the attacker crashes the affected service or process, causing a denial of service to any workload depending on Escargot for script evaluation.