CVE-2026-25205
Published: 13 April 2026
Summary
CVE-2026-25205 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25205 is a heap-based buffer overflow vulnerability in Samsung Open Source Escargot that allows out-of-bounds writes. The issue affects Escargot at commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 and is classified under CWE-122. It received a CVSS v3.1 base score of 7.4.
The vulnerability can exploited by a local attacker with no privileges (PR:N), requiring local access (AV:L) and high attack complexity (AC:H), with no user interaction needed (UI:N) and unchanged scope (S:U). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution or system compromise.
The GitHub pull request at https://github.com/Samsung/escargot/pull/1554 provides the patch addressing this vulnerability, serving as the primary mitigation for affected Escargot instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21819
Vulnerability details
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 .
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in local JS engine with PR:N and code execution impact directly enables local exploitation for privilege escalation to achieve arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this heap-based buffer overflow via the specific patch in the referenced GitHub pull request.
SI-16 enforces memory protections such as ASLR and DEP that prevent exploitation of heap buffer overflows leading to out-of-bounds writes and arbitrary code execution.
SI-10 mandates input validation to check bounds and sizes, mitigating the root cause of the CWE-122 heap buffer overflow in Escargot.