{"id":"CVE-2026-118435","kind":"vulnerability","aliases":["CVE-2026-118435"],"related":[],"title":"Escargot JavaScript engine: out-of-bounds write lets attackers manipulate memory","description":"Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.","summary":"Samsung's Escargot, a JavaScript engine, has an out-of-bounds write flaw that lets an attacker write past the end of a buffer. The sources do not say what input triggers it or what an attacker can achieve beyond memory manipulation.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","escargot","javascript-engine","runtime"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T08:16:29+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","triaged_at":"2026-10-28T08:33:46+00:00","updated_at":"2026-10-28T08:33:46+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T08:33:46Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Escargot JavaScript engine: out-of-bounds write lets attackers manipulate memory","impact":"medium","summary":"Samsung's Escargot, a JavaScript engine, has an out-of-bounds write flaw that lets an attacker write past the end of a buffer. The sources do not say what input triggers it or what an attacker can achieve beyond memory manipulation.","category":"runtime","nicknames":[],"who_cares":["escargot","javascript-engine","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Memory corruption in the JavaScript engine, impact unconfirmed","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118435 and Samsung's escargot repository for affected versions, the fixed commit and the triggering input.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000523,"input_tokens":3255,"output_tokens":395,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118435':15A,18A '-2026':14A,17A 'achiev':64B 'allow':79C 'attack':10A,42B,62B 'beyond':65B 'bound':7A,36B,71C 'buffer':49B,80C 'cve':13A,16A 'embed':19B 'end':46B 'engin':3A,23B,30B 'escargot':1A,20B,27B,78C 'flaw':38B 'input':56B 'javascript':2A,22B,29B 'javascript-engin':21B 'let':9A,40B 'manipul':11A,67B,81C 'memori':12A,66B 'open':76C 'out-of-bound':4A,33B,68C 'past':44B 'runtim':24B 'samsung':25B,75C 'say':54B 'sourc':51B,77C 'trigger':57B 'vulner':73C 'write':8A,37B,43B,72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T08:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"PSIRT@samsung.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118435","severity":null,"published_at":"2026-10-28T08:16:29+00:00","modified_at":"2026-10-28T08:16:29+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","fetched_at":"2026-10-28T08:31:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}