Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-124684

Escargot · Vulnerability

CVSS 3.1 5.7 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-124684

Published

A use-after-free vulnerability exists in Samsung Escargot 5.0.2 in the buffer-access paths for ReloadableString and CompressibleString. Internal raw character accessors and the public StringRef::stringBufferAccessData() API did not preserve the lifetime of the underlying buffer while it remained in use. As a result, idle unloading or garbage-collection compression could release the buffer and leave a stale pointer. Subsequent access may cause the process to crash or, under allocation-dependent conditions, expose limited contents of another heap allocation. The issue was addressed by adding buffer-lifetime reference tracking and removing unsafe raw character accessors.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-124684

Published

Escargot

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Samsung Open Source",
                    "product": "Escargot",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "8bc35b7b88f0f96c66a42aa965a1a710308b61d5",
                            "versionType": "git"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON