The vulnerability is a use‑after‑free flaw that allows an attacker to manipulate a freed pointer, potentially leading to memory corruption or arbitrary code execution. This weakness is categorized as CWE‑416.

Escargot builds from Samsung Open Source are vulnerable in any version prior to commit 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. The affected code resides in the Escape module of the project. No specific release numbers are listed, so the risk applies to all earlier releases until the patch is applied.

The CVSS score is 5.1, indicating a moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploits. The likely attack vector is local exploitation through manipulation of freed pointers, though exact conditions are not detailed. Administrators should treat it as a memory corruption risk until a patch is deployed.