Uncontrolled recursion occurs when rlottie parses serialized data that can trigger an unbounded call stack. This flaw can exhaust memory or crash the process, resulting in a denial of service. The vulnerability reflects CWE-674: Uncontrolled Recursion, and it does not convey an information disclosure or arbitrary code execution vector as described.

The flaw affects the Samsung Open Source rlottie library in all releases prior to commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945. Any software that incorporates this version of rlottie is potentially vulnerable.

The CVSS score of 6.1 classifies the risk as medium. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV, indicating no confirmed public exploitation yet. The likely attack vector is through supplying oversized or malicious serialized payloads to the library, which may be feasible if the host application accepts external data without proper size checks.