An out‑of‑bounds write in the Samsung Open Source Escargot JavaScript engine corrupts adjacent memory, creating a classic buffer overflow condition. Such memory corruption can allow an attacker to overwrite critical control data, resulting in arbitrary code execution, loss of system integrity, and potentially denial of service.

The flaw exists in the Escargot project at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. Systems that incorporate this code, regardless of build or deployment environment, are affected. Updating to a version that includes the missing commit will remove the vulnerability.

The CVSS score of 7.4 indicates high severity. EPSS information is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, so current exploitation likelihood is uncertain. However, because the issue is a classic out‑of‑bounds write, an attacker who can supply crafted JavaScript to Escargot—whether through a web page, script execution, or other automated input—may trigger the overflow. The actual attack vector is not directly stated, so this is inferred from the nature of the defect and typical JavaScript engine usage.