The flaw lies in the handling of the argument count_instr within duk_api_bytecode.c. By manipulating this value an attacker can corrupt memory. The resulting corruption can cause crashes or potentially allow execution of arbitrary code, thereby compromising the confidentiality, integrity and availability of the affected process. The specified impact is realistic only when the attacker can successfully provide crafted input while the vulnerable code is executing.

All installations of the svaarala duktape engine up to version 2.99.99 are impacted. No finer version information is available in the advisory, and the vendor has yet to issue a fix. The advisory specifies svaarala duktape as the affected product and references the official CPE for this product, but the raw CPE string is omitted from the narrative.

The CVSS score of 4.8 indicates a moderate level of risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access, meaning it is relevant only to users who already have some level of access to the target machine. Because a public exploit is available, a local attacker can readily use the vulnerability to destabilize the system or possibly take full control of the process. The overall risk profile is moderate, but the lack of a patch elevates the significance of mitigations based on access control and monitoring.