Technical impact
The vulnerability is an out-of-bounds read in Samsung’s open‑source JavaScript engine Escargot, which can disclose internal resource information to an attacker. This flaw is categorized as CWE‑125 and can potentially expose sensitive data, compromising confidentiality. The exploit would allow an adversary to read memory beyond the intended bounds, revealing details that could be leveraged for further attacks.
Affected Systems
Samsung Open Source Escargot is affected, specifically the code snapshot identified by commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335. No broader version range is documented, so the issue applies to deployments using this revision or derivative builds that have not incorporated the fix.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no widespread exploitation at present. The attack vector is not explicitly described in the available information, but the nature of an out-of-bounds read typically allows local or remote exploitation where the attacker can supply crafted input to trigger the read. Given the moderate score and lack of known exploitation, organizations should treat the flaw as a high‑priority patching item, especially if the affected component processes untrusted input.
