The vulnerability is a memory allocation flaw caused by an excessive size value. This issue allows an attacker to trigger an allocation of an excessively large amount of memory, which can exhaust system resources or cause the Escargot engine to crash. The flaw is classified as CWE‑789 (Uncontrolled Memory Allocation).

The affected product is Samsung Open Source Escargot. The specific commit where the vulnerability exists is 590345cc6258317c5da850d846ce6baaf2afc2d3. The fix has been merged in subsequent commits; users of this commit or earlier versions are vulnerable.

The CVSS score is 5.5, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is not explicitly stated in the advisory, but given the memory allocation context, it is likely exploitable via input that causes large allocations, potentially from any interface that accepts user‑supplied data. Without a patch, an attacker could induce a denial‑of‑service by exhausting memory resources. The risk is moderate but should be mitigated promptly.