Samsung’s open‑source JavaScript engine, Escargot, contains a type‑confusion flaw (CWE‑843) that permits an attacker to manipulate pointers. The vulnerability stems from accepting incompatible types, which can corrupt memory when the engine executes JavaScript that triggers the wrong type handling. This pointer manipulation exposes the process to potential memory corruption, though the official description does not confirm arbitrary code execution or full process control.

All releases of Samsung Open Source Escargot prior to commit 779f6bedf58f334dec64b0a51ebb724b4708b84a are affected. Users operating any earlier version of the engine may be exposed to this flaw.

The CVSS score of 6.1 represents moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploitation. Attacks likely require untrusted or malicious JavaScript passing through Escargot; given the type‑confusion nature, accidental exploitation could lead to memory corruption, but the description does not confirm arbitrary code execution or full process control.