CVE-2026-86315

MediumCVSS 6.2/10Last modified Sep 28, 2026

Description

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX.

This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-197

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-863175.3A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/sr CVE-2026-863185.3A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchD CVE-2026-863195.3A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of t CVE-2026-86327.8A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow CVE-2026-863207.8A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can CVE-2026-863215.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file sr CVE-2026-863259.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuff CVE-2026-863268.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th CVE-2026-86339.8IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Appli CVE-2026-863307.2An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible CVE-2026-863326.5A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes CVE-2026-863344.2Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on