The vulnerability is an out‑of‑bounds read and write that occurs during buffer operations in Escargot’s JavaScript engine. The overflows corrupt memory beyond the intended bounds, allowing an attacker to read protected data or overwrite adjacent memory. These actions can lead to data leakage, service disruption, and, if an attacker can influence the process state, potentially arbitrary code execution. The CVE description indicates no documented remote code execution; based on this, it is inferred that no such exploitation has been reported, though the read/write weaknesses could enable severe compromise under the right conditions.

The vulnerability affects Samsung Open Source Escargot commits before 779f6bedf58f334dec64b0a51ebb724b4708b84a. Any application embedding the engine—such as web browsers, node‑style runtimes, or standalone tools—running an older commit will be affected. Deployments using the patched commit or newer are not impacted.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying no known active exploitation campaigns. The likely attack vector is an attacker delivering crafted JavaScript to Escargot in a context that processes untrusted data. Based on the description, it is inferred that remote code execution has not been documented, but the read/write flaws could, in theory, lead to arbitrary code execution if an attacker can manipulate the process state.