The vulnerability is an out-of-bounds write in the Samsung Open Source Escargot JavaScript engine. By overflowing a buffer, an attacker can corrupt adjacent memory, potentially enabling arbitrary code execution or causing a crash. The flaw is classified as CWE‑787. The compromised memory area could be used to hijack control flow, leading to denial of service or execution of malicious code.

Samsung Escargot, a JavaScript engine maintained by Samsung Open Source. The affected revision is commit 36f5fb58366a67b713c02f6fd985e924fcc09e31. No other versions or broader products are listed.

The CVSS score of 8.8 indicates high severity. EPSS information is not available, so the current exploitation probability is unknown, but the lack of KEV listing suggests no confirmed public exploits yet. The likely attack vector is through malicious JavaScript executed within Escargot, meaning local or remote code execution is possible if the engine processes untrusted input. The risk remains high because a buffer overflow can lead to arbitrary code execution, especially when Escargot runs with system privileges.