A flaw exists in the Samsung Open Source Escargot JavaScript engine that allows untrusted serialized data to be processed without sufficient validation. Deserialization of such data can provoke a process abort, effectively halting the engine and causing a denial of service to any application that relies on it. The weakness is rooted in unsafe deserialization practices and improper type handling, as indicated by the associated CWEs.

The affected product is the Samsung Open Source Escargot JavaScript engine. All releases prior to the code change identified by commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 are vulnerable; versions containing this commit or later are considered safe.

With a CVSS score of 6.2 the vulnerability is classified as medium severity. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit this weakness by delivering maliciously crafted serialized data to Escargot—potentially through web content, script files, or other mechanisms that trigger the engine. The effect is limited to service disruption, with no direct path to data exposure or privilege escalation.