{"id":"CVE-2026-124684","kind":"vulnerability","aliases":["CVE-2026-124684"],"related":[],"title":"Escargot JavaScript engine: use-after-free lets attackers manipulate pointers","description":"Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.\n\nThis issue affects Escargot: before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5.","summary":"Samsung's Open Source Escargot JavaScript engine has a use-after-free bug, where memory is read after it has been released. The sources say it allows pointer manipulation, which can lead to memory corruption.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Escargot","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["escargot","javascript-engine","runtime","samsung"],"not_affected_if":["does-not-embed-escargot"],"how_to_check":"- Check whether the Escargot build in use predates commit `8bc35b7b88f0f96c66a42aa965a1a710308b61d5`","fix":"- Escargot: move to a build at or after commit `8bc35b7b88f0f96c66a42aa965a1a710308b61d5`","status":"open","published_at":"2026-11-09T12:16:38+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:26+00:00","updated_at":"2026-11-09T12:27:26+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T12:27:26Z","model":"claude-haiku-5-5","output":{"fix":"- Escargot: move to a build at or after commit `8bc35b7b88f0f96c66a42aa965a1a710308b61d5`","reach":"unknown","title":"Escargot JavaScript engine: use-after-free lets attackers manipulate pointers","impact":"high","summary":"Samsung's Open Source Escargot JavaScript engine has a use-after-free bug, where memory is read after it has been released. The sources say it allows pointer manipulation, which can lead to memory corruption.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["escargot","javascript-engine","samsung"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"memory corruption that may let attackers run code","analyst_note":"Confirm the attack vector and whether Escargot is embedded in any shipped product, using the linked GitHub patch commit.","how_to_check":"- Check whether the Escargot build in use predates commit `8bc35b7b88f0f96c66a42aa965a1a710308b61d5`\n- unknown beyond that, the sources do not say how to confirm exposure","plain_action":"","product_name":"Escargot","needs_analyst":true,"not_affected_if":["does-not-embed-escargot"],"who_is_affected":"Anything that embeds the Escargot JavaScript engine built before the fixing commit is exposed. Projects that do not ship or embed Escargot can skip it. The sources do not describe the exact data path that reaches the flawed code.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4535,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124684':14A,17A '-2026':13A,16A '8bc35b7b88f0f96c66a42aa965a1a710308b61d5':78C 'affect':75C 'allow':52B,70C 'attack':9A 'bug':38B 'corrupt':60B 'cve':12A,15A 'engin':3A,22B,31B 'escargot':1A,18A,19B,29B,69C,76C 'free':7A,37B,63C 'issu':74C 'javascript':2A,21B,30B 'javascript-engin':20B 'lead':57B 'let':8A 'manipul':10A,54B,72C 'memori':40B,59B 'open':27B,67C 'pointer':11A,53B,71C 'read':42B 'releas':47B 'runtim':23B 'samsung':24B,25B,66C 'say':50B 'sourc':28B,49B,68C 'use':5A,35B,61C 'use-after-fre':4A,34B 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Anything that embeds the Escargot JavaScript engine built before the fixing commit is exposed. Projects that do not ship or embed Escargot can skip it. The sources do not describe the exact data path that reaches the flawed code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["escargot"],"ptokens":["escargot"],"labels":["escargot","javascriptengine","medium","runtime","samsung","vendor"],"campaign_type":null,"search_a":"'-124684':14A,17A '-2026':13A,16A 'attack':9A 'cve':12A,15A 'engin':3A 'escargot':1A,18A 'free':7A 'javascript':2A 'let':8A 'manipul':10A 'pointer':11A 'use':5A 'use-after-fre':4A","search_b":"'allow':52B 'bug':38B 'corrupt':60B 'engin':22B,31B 'escargot':19B,29B 'free':37B 'javascript':21B,30B 'javascript-engin':20B 'lead':57B 'manipul':54B 'memori':40B,59B 'open':27B 'pointer':53B 'read':42B 'releas':47B 'runtim':23B 'samsung':24B,25B 'say':50B 'sourc':28B,49B 'use':35B 'use-after-fre':34B","search_c":"'8bc35b7b88f0f96c66a42aa965a1a710308b61d5':78C 'affect':75C 'allow':70C 'escargot':69C,76C 'free':63C 'issu':74C 'manipul':72C 'open':67C 'pointer':71C 'samsung':66C 'sourc':68C 'use':61C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"PSIRT@samsung.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124684","severity":null,"published_at":"2026-11-09T12:16:38+00:00","modified_at":"2026-11-09T12:16:38+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[{"id":107334,"url":"https://github.com/Samsung/escargot/commit/8bc35b7b88f0f96c66a42aa965a1a710308b61d5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}