PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47311 Samsung Open Source CVE debrief

A heap-based buffer overflow vulnerability exists in Samsung Open Source Escargot, a JavaScript engine. The vulnerability affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3 and is classified as CWE-122 (Heap-based Buffer Overflow). The CVSS 3.1 vector indicates a local attack vector requiring user interaction, with high impacts to confidentiality, integrity, and availability. Samsung's PSIRT has identified a remediation pull request addressing this issue.

Vendor
Samsung Open Source
Product
Escargot
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations deploying Samsung Escargot JavaScript engine in embedded systems, IoT devices, or server-side JavaScript execution environments; security teams tracking memory safety vulnerabilities in language runtimes; developers maintaining applications dependent on Escargot for JavaScript execution.

Technical summary

CVE-2026-47311 is a heap-based buffer overflow (CWE-122) in Samsung's Open Source Escargot JavaScript engine. The vulnerability is present in commit 590345cc6258317c5da850d846ce6baaf2afc2d3. With a CVSS 3.1 score of 7.8 (HIGH), the attack requires local access and user interaction but can result in complete compromise of confidentiality, integrity, and availability. Samsung PSIRT has referenced a GitHub pull request (1565) as the remediation path. The NVD entry remains under analysis as of the modified date.

Defensive priority

HIGH

Recommended defensive actions

  • Review Samsung Escargot deployment inventory to identify systems running affected commit 590345cc6258317c5da850d846ce6baaf2afc2d3
  • Monitor GitHub pull request 1565 for merge status and official patch release from Samsung
  • Apply vendor-supplied patch when available; prioritize systems processing untrusted JavaScript input
  • Implement application sandboxing and input validation controls to reduce attack surface
  • Track NVD analysis status for updated technical details and confirmed fix versions

Evidence notes

CVE published 2026-05-19T07:16:30.070Z; modified 2026-05-19T14:25:40.320Z. NVD status: Undergoing Analysis. Samsung PSIRT reference to GitHub pull request 1565 provided as remediation evidence. CVSS 3.1 score 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47311 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47311

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47311 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47311

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.