The vulnerability is an out‑of‑bounds read that allows the Escargot JavaScript engine to read data from memory addresses beyond the intended buffer boundaries. A crafted input can expose sensitive data stored adjacent to the buffer and may also trigger a reachable assertion that can destabilize the engine or cause a crash. Thus an attacker who can provide malicious JavaScript is able to obtain confidential information or induce a denial‑of‑service.

Samsung Open Source Escargot installations that include code before commit 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c are affected. The defect resides in the core JavaScript engine component maintained in Samsung’s public repository.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of < 1% shows a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is the execution of specially crafted JavaScript that causes the engine to read beyond a buffer; exploitation requires an attacker to supply such input, which is common in web scenarios that render untrusted scripts. Successful exploitation can lead to disclosure of confidential data or destabilization of the runtime.