Technical impact
A memory allocation flaw in the Samsung Open Source rlottie library allows an attacker to specify an excessively large size value, resulting in an overly large memory allocation. This can lead to a program crash or consume system resources until the process becomes unresponsive. The weakness is categorized as CWE‑789, indicating an issue with improper handling of memory allocation limits.
Affected Systems
The vulnerability affects the Samsung Open Source rlottie library in all releases older than commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd. Any system that processes lottie animation files with this library is potentially impacted.
Risk and Exploitability
The CVSS score of 6.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation risk. However, the likely attack vector is the delivery of a crafted lottie file that causes the library to allocate an excessively large buffer. If an attacker succeeds, they can induce a denial of service by exhausting system memory or causing a crash. The absence of a public exploit does not negate the risk, as the flaw is straightforward to test and could be exploited by a motivated attacker.
Debian DLA
Ubuntu USN