CVE-2026-25208

CVE-2026-25208 is an integer overflow vulnerability affecting Samsung's Open Source Escargot JavaScript engine (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335), which can lead to buffer overflow conditions and potential code execution. The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector, high complexity requirements, and no authentication needed, resulting in high impact across confidentiality, integrity, and availability. The attack requires specific conditions to exploit (high complexity) but can be delivered remotely without user interaction. Exploitation activity is currently not widespread, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows minimal community attention with an EPSS score of 0.0006. Organizations using Escargot should prioritize patching, though the moderate risk score of 49.0/100 suggests this is not yet an urgent critical threat compared to actively exploited vulnerabilities.