ESCARGOT · CVE-2026-124684 · Runtime
NO FIX YET · SEE WHAT TO DO
Samsung's Open Source Escargot JavaScript engine has a use-after-free bug, where memory is read after it has been released. The sources say it allows pointer manipulation, which can lead to memory corruption.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anything that embeds the Escargot JavaScript engine built before the fixing commit is exposed. Projects that do not ship or embed Escargot can skip it. The sources do not describe the exact data path that reaches the flawed code.
Not affected if does-not-embed-escargot
Who cares escargot, javascript-engine, samsung
8bc35b7b88f0f96c66a42aa965a1a710308b61d58bc35b7b88f0f96c66a42aa965a1a710308b61d5Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.