CVE-2026-25204

State: Published
Severity: 6.2 Medium
Published: Apr 13, 2026
Updated: Apr 14, 2026
Reserved: Jan 30, 2026

Description

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort.

This issue affects escarogt prior to commit hash

97e8115ab1110bc502b4b5e4a0c689a71520d335

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	samsung.tv_appliance

Weaknesses

CWE-502 Deserialization of untrusted data
CWE-843 Access of resource using incompatible type ('type confusion')

Affected Products

Product	Versions
EscargotSamsung Open Source	97e8115ab1110bc502b4b5e4a0c689a71520d335Affected

References

https://github.com/Samsung/escargot/pull/1554

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.