Escargot, Samsung Open Source JavaScript engine, contains an out‑of‑bounds write that can corrupt memory and lead to buffer overflows. The flaw is identified as CWE‑787 and, if exploited, could allow an attacker to execute arbitrary code or crash the engine, thereby compromising the integrity of the host system.

The vulnerability exists in the Escargot source at commit 590345cc6258317c5da850d846ce6baaf2afc2d3. No formal product version numbers are listed; the issue applies to any build that includes this commit before the fix.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. Attackers would need to deliver malicious JavaScript that triggers the out‑of‑bounds write; the precise attack vector is inferred from the nature of Escargot as a JavaScript engine, suggesting a local or browser‑based exploitation scenario.