CVE-2026-86315

A flaw was found in Samsung Open Source Escargot. This out-of-bounds write vulnerability, caused by numeric truncation, allows an attacker to corrupt native memory. By supplying specially crafted JavaScript for execution, a remote attacker can trigger this flaw, leading to the host process crashing and resulting in a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat because successful exploitation requires supplying untrusted code to the engine and is limited in blast radius to process termination rather than privilege escalation. Samsung Escargot is not deployed by default in standard Red Hat Enterprise Linux environments, significantly restricting exposure. Consequently, the impact is confined to standalone or specialized applications running the engine that actively parse untrusted input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.