{"id":"CVE-2026-86315","aliases":["EUVD-2026-72246","GHSA-xh23-cpx8-xqgm"],"status":"published","title":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64...","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00172,"percentile":0.06715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-197"],"published":"2026-09-07T04:01:28Z","modified":"2026-10-28T02:30:31Z","products":[{"vendor":"samsung open source","product":"escargot"},{"vendor":"samsung opensource","product":"escargot"}],"references":[{"url":"https://github.com/Samsung/escargot/pull/1660","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86315","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xh23-cpx8-xqgm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86315.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-86315","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","status":"published","published":"2026-09-07T04:01:28.554Z","modified":"2026-09-08T14:53:47.552Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-197"],"updated_at":"2026-11-02T13:49:42.666099Z"}],"euvd":[{"id":"EUVD-2026-72246","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","status":"published","published":"2026-09-07T04:01:28Z","modified":"2026-09-08T14:53:47Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:29.426Z"}],"ghsa":[{"id":"GHSA-xh23-cpx8-xqgm","title":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64...","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","status":"published","published":"2026-09-07T06:30:24Z","modified":"2026-09-07T06:30:33Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-197"],"updated_at":"2026-11-02T15:11:26.557204Z"}],"nvd":[{"id":"CVE-2026-86315","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","status":"published","published":"2026-09-07T04:17:55.65Z","modified":"2026-09-28T23:10:00.143Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-197"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-86315","description":"An out-of-bounds write caused by numeric truncation  Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.\n\n\n\nThis issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.","status":"published","published":"2026-09-07T04:01:28.554Z","modified":"2026-10-28T02:30:31.0295856Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-197"],"updated_at":"2026-11-02T15:45:18.825071Z"}]}}