Samsung Open Source vulnerabilities

Products

• Escargot 31
• rlottie 18
• ONE 9
• mTower 3
• Walrus 3
• Vyond 2
• QA-Board 1
• TizenFX 1

Latest Samsung Open Source CVEs

Newest publication first · page 1 of 3

1. CVE-2026-124684 This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character pointer remains in use. Successful triggering may cause the Esca...

   Published 2026-11-09

   Medium·CVSS 5.1 EPSS 0.10%

   This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character pointer remains in use. Successful triggering may cause the Escargot-based process to crash, resulting in a denial of service.

2. CVE-2026-118435 Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

   Published 2026-10-28

   Medium·CVSS 5.4 EPSS 0.21%

   Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

3. CVE-2026-110934 Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.

   Published 2026-10-15

   Medium·CVSS 4.4 EPSS 0.11%

   Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.

4. CVE-2026-110933 Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.

   Published 2026-10-15

   Medium·CVSS 4.4 EPSS 0.11%

   Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.

5. CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

   Published 2026-10-14

   Critical·CVSS 9.8 EPSS 1.2%

   Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

6. CVE-2026-85084 Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

   Published 2026-09-02

   Medium·CVSS 6.3 EPSS 0.13%

   Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

7. CVE-2026-10420 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

   Published 2026-09-01

   Medium·CVSS 5.5 EPSS 0.15%

   Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

8. CVE-2026-82927 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

   Published 2026-09-01

   Medium·CVSS 5.5 EPSS 0.15%

   Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

9. CVE-2026-82926 NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

   Published 2026-09-01

   Medium·CVSS 5.5 EPSS 0.15%

   NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

10. CVE-2026-82797 rlottie: rlottie: Denial of Service via uncontrolled recursion with serialized data

    Published 2026-08-31

    Medium·CVSS 5.5 EPSS 0.15%

    Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.

11. CVE-2026-19588 Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

    Published 2026-08-12

    Medium·CVSS 6.5 EPSS 0.35%

    Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

12. CVE-2026-19587 rlottie: rlottie: Denial of Service due to excessive resource allocation

    Published 2026-08-12

    Medium·CVSS 6.5 EPSS 0.36%

    Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

13. CVE-2026-19518 Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

    Published 2026-08-11

    Medium·CVSS 6.5 EPSS 0.36%

    Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

14. CVE-2026-19517 Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

    Published 2026-08-11

    Medium·CVSS 6.5 EPSS 0.36%

    Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

15. CVE-2026-18772 Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

    Published 2026-08-04

    Medium·CVSS 6.5 EPSS 0.36%

    Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

16. CVE-2026-15551 Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

    Published 2026-07-13

    Medium·CVSS 5.5 EPSS 0.11%

    Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .

17. CVE-2026-58307 Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731f...

    Published 2026-07-09

    Medium·CVSS 6.1 EPSS 0.15%

    Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

18. CVE-2026-58306 Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.

    Published 2026-07-09

    Medium·CVSS 6.1 EPSS 0.16%

    Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.

19. CVE-2026-58305 Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 779f6bedf58f334dec64b0a51eb...

    Published 2026-07-09

    Medium·CVSS 6.1 EPSS 0.15%

    Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.

20. CVE-2026-58304 Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.

    Published 2026-07-09

    Medium·CVSS 6.1 EPSS 0.16%

    Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.

21. CVE-2026-58303 Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137da1c65aaa4521fe74e.

    Published 2026-07-09

    Medium·CVSS 6.1 EPSS 0.16%

    Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137da1c65aaa4521fe74e.

22. CVE-2026-14160 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d...

    Published 2026-06-30

    Medium·CVSS 5.9 EPSS 0.12%

    Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d.

23. CVE-2026-8916 Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.

    Published 2026-06-04

    Medium·CVSS 6.1 EPSS 0.10%

    Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.

24. CVE-2026-47318 Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

    Published 2026-06-04

    Medium·CVSS 6.1 EPSS 0.11%

    Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

25. CVE-2026-47306 Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

    Published 2026-06-04

    Medium·CVSS 6.1 EPSS 0.10%

    Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.