FKIE_CVE-2026-47320

Vulnerability from fkie_nvd - Published: 2026-06-04 10:16 - Updated: 2026-07-22 20:10
Severity
6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Summary
Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads. This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.
References
PSIRT@samsung.comhttps://github.com/Samsung/rlottie/pull/593
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "eae37633fda13ac05b25c6c95aacea4bc33c80a3"
            }
          ]
        }
      ],
      "source": "PSIRT@samsung.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3."
    },
    {
      "lang": "es",
      "value": "Acceso de puntero no inicializado, vulnerabilidad de recursi\u00f3n no controlada en rlottie de c\u00f3digo abierto de Samsung permite manipulaci\u00f3n de punteros, cargas \u00fatiles de datos serializados de tama\u00f1o excesivo.\n\nEste problema afecta a rlottie: antes de eae37633fda13ac05b25c6c95aacea4bc33c80a3."
    }
  ],
  "id": "CVE-2026-47320",
  "lastModified": "2026-07-22T20:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2,
        "source": "PSIRT@samsung.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47320",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T12:19:42.336040Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-04T10:16:39.323",
  "references": [
    {
      "source": "PSIRT@samsung.com",
      "url": "https://github.com/Samsung/rlottie/pull/593"
    }
  ],
  "sourceIdentifier": "PSIRT@samsung.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        },
        {
          "lang": "en",
          "value": "CWE-824"
        }
      ],
      "source": "PSIRT@samsung.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.