Escargot contains a type confusion flaw that allows the creation of pointers when an object of an incompatible type is accessed. This vulnerability (CWE‑843) provides the attacker with the ability to manipulate memory addresses arbitrarily. If successfully exploited, it could lead to memory corruption, arbitrary code execution, or privilege escalation within the process that runs Escargot.

The affected product is Samsung Open Source Escargot, a JavaScript engine used in Samsung devices and applications. The flaw was present in the code base at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335 and later fixed by the merged pull request noted in the official reference.

The CVSS score of 6.9 indicates a medium‑severity vulnerability. Exploitation likely requires execution of untrusted JavaScript within Escargot, suggesting a local or remote code execution vector through scripting or loading of malicious scripts. No EPSS data or KEV listing is available, so the current attack likelihood cannot be precisely quantified, but the vulnerability could be leveraged by attackers with access to code execution environments that depend on Escargot.