Technical impact
An out-of-bounds read flaw in Samsung Open Source Escargot permits the program to read memory beyond its intended boundary, exposing internal data structures and heap contents. Classified as CWE‑125, the vulnerability can disclose sensitive information without causing a crash or altering program state. It becomes exploitable when Escargot processes malformed inputs, enabling the reading of unintended memory regions.
Affected Systems
The flaw resides in Samsung Open Source Escargot and is identified by the commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335. No specific release or version number is enumerated in the advisory, so any revision that contains this commit remains vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 6.7 indicates moderate severity, suggesting that an attacker can gain partial data disclosure but lacks the capability for remote code execution. The EPSS score is unavailable and the vulnerability has not been listed in the CISA KEV catalog, implying no confirmed public exploits are known. Exfiltration of data would likely be limited to environments where the Escargot engine is exposed to untrusted input; the vulnerability requires crafted input to trigger the out-of-bounds read.
