An out‑of‑bounds write caused by numeric truncation in Samsung’s Escargot engine corrupts native memory when a class definition is crafted with an instance initialization entry count larger than UINT16_MAX. This overflow allows an attacker who can supply JavaScript to execute to crash the host process and potentially compromise integrity by corrupting adjacent memory.

Samsung Open Source Escargot running on Linux x86‑64, specifically the build identified by commit 5dc93606abd42b859045add05d704a038e197359. No other version information is available.

The CVSS score of 6.2 signals a moderate severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to control JavaScript execution, such as by injecting malicious scripts into a web page that uses Escargot. Once executed, the numeric truncation leads to an out‑of‑bounds write that can corrupt memory, trigger a crash, and expose the host process to potential exploitation.