CVE-2026-25204

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Samsung/escargot/pull/1554	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:escargot:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-13 01:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25204

Mitre link : CVE-2026-25204

CVE.ORG link : CVE-2026-25204

JSON object : View

Products Affected

samsung

escargot

CWE

CWE-502

Deserialization of Untrusted Data

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2026-25204", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25204", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T17:36:54.369644Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "PSIRT@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "PSIRT@samsung.com", "affectedData": [{"vendor": "Samsung Open Source", "product": "Escargot", "versions": [{"status": "affected", "version": "97e8115ab1110bc502b4b5e4a0c689a71520d335"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-13T01:16:35.313", "references": [{"url": "https://github.com/Samsung/escargot/pull/1554", "tags": ["Issue Tracking", "Patch"], "source": "PSIRT@samsung.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "PSIRT@samsung.com", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort.\n\nThis issue affects escarogt prior to\u00a0commit hash \n\n97e8115ab1110bc502b4b5e4a0c689a71520d335"}], "lastModified": "2026-06-17T10:24:18.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:escargot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B02C4168-2275-4F2B-AB72-BD2072E8A682", "versionEndExcluding": "2026-03-28"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT@samsung.com"}