Technical impact
An integer overflow or wraparound occurs within the Samsung Open Source Escargot JavaScript engine, producing undefined behavior when certain calculations propagate beyond their intended range. This flaw could lead to incorrect program logic or memory corruption if exploited. The vulnerability is tied to CWE‑190 and its impact is primarily integrity and stability of the Escargot runtime, potentially affecting any application that embeds this engine and processes unchecked data.
Affected Systems
Samsung Open Source Escargot is affected, specifically the code at commit 97e8115ab1110bc502b4b5e4a0c689a71520d335. No additional version details are provided, but the flaw exists in the code base referenced in that commit.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is that an attacker must supply crafted input to the Escargot engine; exploitation could be local or remote depending on how the engine is used. Because the issue causes undefined behavior rather than direct code execution, the threat is limited to potential instability or data manipulation unless further vulnerabilities are present.
