VulnerabilityDeferred

CVE-2026-47320

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.

MEDIUM 6.1EPSS 0.10%

Does this matter?

Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.

Description

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads. This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS: 0.10% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-674, CWE-824
Source: PSIRT@samsung.com

References

https://github.com/Samsung/rlottie/pull/593

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.