The vulnerability is a heap‐based buffer overflow (CWE‑122) in the Samsung Escargot JavaScript engine. An attacker who can supply specially crafted data to an Escargot process could cause a buffer overflow on heap memory, corrupting adjacent memory and potentially leading to memory corruption or denial of service. While the description does not explicitly state the exact attack vector, it is inferred that an attacker would need to deliver malicious input—such as an oversized or malformed script—to an Escargot instance in order to trigger the overflow.

Samsung Open Source Escargot versions built from revisions earlier than the commit ef525f337fafddecde77a3c426212a84bb20cb98 are affected. Updates to this commit or later provide the necessary fix.

The CVSS v3.1 score of 6.1 indicates a moderate severity, and the EPSS score of <1% implies a very low likelihood of exploitation in the wild. Escargot is not listed in the CISA Key Exploited Vulnerabilities catalog, and no public exploitation reports are known. Exploitation would require an attacker to direct malicious data to a running Escargot process, likely through a web or embedded context that processes user-controlled scripts.