This vulnerability in svaarala duktape up to version 2.99.99 involves a weakness in the processing of the argument count_instr within the duk_api_bytecode.c source file. Manipulating this argument can cause memory corruption. The attack vector requires local access, and no user interaction is needed. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 base score is 4.8, reflecting medium severity with local attack vector and low complexity.

Successful exploitation can result in memory corruption, which may cause application instability or crashes. Since the attack requires local access, remote exploitation is not possible. The public availability of an exploit increases the risk of local attacks. However, the medium CVSS score indicates limited impact compared to higher severity vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should restrict local access to trusted users only and monitor for suspicious local activity. Avoid running untrusted code or scripts that could manipulate the vulnerable component until a patch is released.