CVE-2026-86315 Details
Description
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.
A vulnerability allowing out-of-bounds write has been identified in Samsung Open Source Escargot on Linux x86-64. This issue arises from numeric truncation, which allows an attacker to supply JavaScript for execution that can corrupt native memory and crash the host process. The vulnerability is triggered by a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Samsung/escargot/pull/1660 | [email protected] | Issue TrackingVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-197 | Numeric Truncation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Samsung Open Source Escargot | 5dc93606abd42b859045add05d704a038e197359 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |