The vulnerability is a stack‑based buffer overflow in the Samsung Open Source Escargot JavaScript engine. The overflow allows malicious or malformed script input to overwrite local variables on the stack, potentially corrupting memory, leading to unauthorized code execution or causing a crash. This flaw is classified as CWE‑121 and carries a CVSS score of 6.1, indicating moderate impact on confidentiality, integrity, and availability of applications that embed the engine.

The affected product is the Samsung Open Source Escargot JavaScript engine. Builds and releases prior to the commit identified by b30b63fc63b403907d8137da1c65aaa4521fe74e contain the flaw. Any deployment that incorporates this version of Escargot is vulnerable until the patch from pull request 1585 is applied or the engine is upgraded to a later commit.

The CVSS score of 6.1 reflects moderate severity, while the EPSS score is reported as less than 1%, suggesting a low likelihood of active exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector would involve delivering a crafted JavaScript payload to an application that uses Escargot, but the CVE entry does not explicitly state the vector. Systems that expose the engine to untrusted input constitute the principal risk surface.