CVE-2026-47320

The vulnerability in Samsung’s open‑source rlottie library involves access of an uninitialized pointer and uncontrolled recursion triggered by oversized serialized data payloads. These flaws can cause the rendering engine to crash or consume excessive stack resources, resulting in service interruption or denial of service for the host application.

Samsung rlottie, any application incorporating the library, is affected for all releases before the commit eae37633fda13ac05b25c6c95aacea4bc33c80a3. Applications maintaining older versions should verify their installed commit hash and consider upgrading to a newer release.

With a CVSS score of 6.1, the vulnerability represents a moderate threat. No EPSS score is available, and the issue is not listed in CISA KEV, indicating no confirmed exploits to date. The likely attack vector is the delivery of a malicious Lottie file to a vulnerable application, which could trigger the uninitialized pointer use and uncontrolled recursion, leading to a crash. Though exploitation is plausible, the lack of known attacks and the moderate severity suggest careful monitoring and patching as the preferred mitigation path.