Technical impact
The vulnerability is an out-of-bounds read in the Samsung Open Source rlottie library, identified as CWE‑125, which permits an attacker to read memory beyond allocated buffers. This buffer overread can expose sensitive data or system state that should not be accessed, potentially leading to information disclosure.
Affected Systems
Samsung Open Source rlottie versions prior to commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd are affected. No other vendors or product versions are listed in the CNA data.
Risk and Exploitability
The CVSS score of 6.1 classifies this as a medium severity issue. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no current exploitation reports. The attack vector is not explicitly stated; the likely exploitation scenario involves feeding crafted data to rlottie, which processes Lottie animation files. An attacker with the ability to influence these inputs could trigger the buffer overread.
Debian DLA
Ubuntu USN