CVE-2026-47320

FAUCET Score

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads. This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.

First published: Jun 4, 2026Last modified: Jun 4, 2026

CVSS Data

CVSS version used by this source: 3.1

6.1MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

4.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.10%

Probability of exploitation in next 30 days

EPSS Percentile

1.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0010 is in the 1st percentile among its peer group of 5,765 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

ubuntupatch availablevia ubuntu_usn

Product: rlottie (focal)Fixed in: 0~git20200305.a717479+dfsg-1ubuntu0.1~esm3

ubuntupatch availablevia ubuntu_usn

Product: rlottie (jammy)Fixed in: 0.1+dfsg-2ubuntu0.2+esm1

ubuntupatch availablevia ubuntu_usn

Product: rlottie (noble)Fixed in: 0.1+dfsg-4ubuntu1.1+esm1

ubuntupatch availablevia ubuntu_usn

Product: rlottie (resolute)Fixed in: 0.1+dfsg-4.3ubuntu0.1~esm1

Vendor Advisories (1)

ubuntuUSN-8559-1

rlottie vulnerabilities

Jul 20, 2026

References

github.com / Samsung/rlottie/pull/593