CVE-2026-40447

CVE-2026-40447 is an integer overflow or wraparound vulnerability in Samsung Open Source Escargot JavaScript engine that can trigger undefined behavior during execution. This issue affects a specific version of Escargot (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335) and potentially any systems or applications that depend on this component. The vulnerability has a CVSS score of 5.1 (Medium severity) with a local attack vector and high attack complexity, meaning an attacker would need local access to the system and specific conditions to exploit it. The primary impact is availability (denial of service), with no direct confidentiality or integrity implications. The EPSS score of 0.00017 indicates this vulnerability is not yet receiving significant real-world exploitation attention compared to other disclosed CVEs. There is currently no evidence of active exploitation in the wild, no known publicly available exploit code, and minimal community attention to this vulnerability. It is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat lists, suggesting limited practical risk in the current threat landscape.