Description

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-07T04:17:55.650Z",
  "pubdate": "2026-09-07T04:17:55.650Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) write condition within the Samsung Open Source Escargot JavaScript engine on Linux x86-64 platforms.\nThe root cause is a numeric truncation error occurring during the processing of class definitions where the instance initialization entry count exceeds the capacity of a 16-bit unsigned integer (UINT16_MAX).\nAn attacker capable of executing arbitrary JavaScript within the Escargot environment can leverage this flaw to corrupt native process memory, leading to an application crash or potentially more severe exploitation scenarios.\nThe vulnerability affects Escargot version 5dc93606abd42b859045add05d704a038e197359.\nExploitation requires the attacker to successfully inject and execute malicious JavaScript code that defines a class structure meeting the specific overflow criteria.\nThe primary risk is a denial-of-service (DoS) condition via process instability, though memory corruption vulnerabilities in JavaScript engines often serve as precursors to arbitrary code execution (ACE) if memory layout can be manipulated effectively.",
  "technicalDetails": "The vulnerability originates from improper handling of integer types during the parsing and initialization phase of JavaScript class definitions. Within the Escargot engine, the internal metadata structure responsible for tracking instance initialization entries relies on a 16-bit unsigned integer (UINT16) to store the count.\nWhen a specially crafted JavaScript class definition is processed, the engine fails to perform adequate bounds checking on the initialization entry count. If an attacker provides a class definition that forces the initialization count to exceed UINT16_MAX (65,535), the value undergoes numeric truncation. For example, a value of 65,536 would be truncated to 0, or higher values would wrap around to a small positive integer.\nThe attack flow proceeds as follows: First, the attacker supplies a malicious payload containing an excessively complex class definition. Second, the Escargot parser processes this definition and populates the internal structure. Third, due to the truncation, the engine allocates an insufficient amount of native memory for the subsequent operations that depend on this count. Finally, the engine performs an out-of-bounds write operation, attempting to write data into a memory buffer that is smaller than the amount of data being processed. This OOB write operation results in heap or stack corruption depending on the memory allocation strategy of the engine.\nBecause the write operation occurs in native memory as a direct result of the JavaScript engine's internal logic, it bypasses the standard JavaScript sandboxing protections. The corruption of native memory addresses, control structures, or function pointers within the process space leads to an immediate state of instability, typically causing the host process to terminate unexpectedly.\nThe requirement for exploitation is the ability to execute JavaScript within the targeted context. No elevated privileges are required to trigger the crash, as the vulnerability is inherent to the engine's memory management logic. While the primary documented impact is a process crash, the capability to perform an out-of-bounds write to native memory is a high-severity primitive that may allow for more sophisticated exploitation techniques, such as the overwriting of return addresses or the manipulation of objects residing in adjacent memory segments, provided the attacker can achieve deterministic heap grooming or memory layout predictability."
}