Escargot, Samsung’s open‑source JavaScript engine, contains a use‑after‑free flaw that allows attackers to manipulate pointers and corrupt memory. The vulnerability (CWE‑416) can be triggered by feeding specially crafted input to the engine and leads to escalation of privileges or arbitrary code execution on the host system.

The defect resides in the code base identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. Any Escargot releases or forked versions that include this commit before the changes in pull request 1565 are vulnerable. Devices or applications that embed the affected runtime without the fix are at risk.

The CVSS score of 7.8 classifies the vulnerability as high severity. EPSS data is not available, so the exact likelihood of exploitation is unknown, but the absence from the CISA KEV list does not diminish the need for prompt action. Based on the description, it is inferred that attackers could exploit the flaw remotely by supplying crafted input, leading to memory corruption and potential remote code execution if the engine is exposed to untrusted data.