Every CVE Search/ Get API key

CVE-2026-47319

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows...

6.1 MediumFix available

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.10%Up 0.1 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
CVE-2026-47319
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-789
Updated
2026-11-02
EUVDEUVD-2026-34233 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
EUVD-2026-34233
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5j7g-c464-cj57 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows...

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
GHSA-5j7g-c464-cj57
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-789
Updated
2026-11-02
NVD 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
CVE-2026-47319
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-789
Updated
2026-11-02
OSV 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
CVE-2026-47319
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-789
Updated
2026-11-02
OSVDEBIAN-CVE-2026-47319 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
DEBIAN-CVE-2026-47319
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-47319 6.1

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

Record
UBUNTU-CVE-2026-47319
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUSN-8559-1 No score

rlottie vulnerabilities

It was discovered that rlottie incorrectly handled certain shift operations. An attacker could possibly use this issue to cause rlottie to read out of bounds, resulting in a denial of service or exposing sensitive information. (CVE-2026-10305)

It was discovered that rlottie did not properly limit recursion when processing certain Lottie animations. An attacker could possibly use this issue to cause rlottie to crash, resulting in a denial of service. (CVE-2026-47306)

It was discovered that rlottie incorrectly handled certain span coordinates. An attacker could possibly use this issue to cause a stack-based buffer overflow, resulting in a denial of service or possibly the execution of arbitrary code. (CVE-2026-47318)

It was discovered that rlottie incorrectly handled certain path data. An attacker could possibly use this issue to cause rlottie to allocate an excessive amount of memory, resulting in a denial of service. (CVE-2026-47319)

It was discovered that rlottie did not properly limit recursion and could access an uninitialized pointer when processing certain Lottie animations. An attacker could possibly use this issue to cause rlottie to crash, resulting in a denial of service. (CVE-2026-47320)

It was discovered that rlottie incorrectly handled certain array lengths in the bundled FreeType raster code. An attacker could possibly use this issue to cause an out-of-bounds write, resulting in a denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-8916)

Record
USN-8559-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rlottie
Debian:12
 before 0.1+dfsg-4+deb12u2, plus listed versions
0.1+dfsg-40.1+dfsg-4+deb12u1
0.1+dfsg-4+deb12u2
rlottie
Debian:13
 before 0.1+dfsg-4.2+deb13u2, plus listed versions
0.1+dfsg-4.20.1+dfsg-4.2+deb13u1
0.1+dfsg-4.2+deb13u2
rlottie
Debian:14
 before 0.1+dfsg-5, plus listed versions
0.1+dfsg-4.20.1+dfsg-4.3
0.1+dfsg-5
rlottie
Ubuntu:Pro:20.04:LTS
 before 0~git20200305.a717479+dfsg-1ubuntu0.1~esm3, plus listed versions
0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm2
0~git20200305.a717479+dfsg-1ubuntu0.1~esm3
rlottie
Ubuntu:Pro:22.04:LTS
 before 0.1+dfsg-2ubuntu0.2+esm1, plus listed versions
0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.2
0.1+dfsg-2ubuntu0.2+esm1
rlottie
Ubuntu:Pro:24.04:LTS
 before 0.1+dfsg-4ubuntu1.1+esm1, plus listed versions
0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.1
0.1+dfsg-4ubuntu1.1+esm1
rlottie
Ubuntu:25.10
 All versions, plus listed versions
0.1+dfsg-4.20.1+dfsg-4.2ubuntu0.1
 None known
rlottie
Ubuntu:Pro:26.04:LTS
 before 0.1+dfsg-4.3ubuntu0.1~esm1, plus listed versions
0.1+dfsg-4.20.1+dfsg-4.3
0.1+dfsg-4.3ubuntu0.1~esm1
rlottie
Ubuntu:Pro:20.04:LTS
From an advisory covering 6 CVEs
 before 0~git20200305.a717479+dfsg-1ubuntu0.1~esm3, plus listed versions
0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm2
0~git20200305.a717479+dfsg-1ubuntu0.1~esm3
rlottie
Ubuntu:Pro:22.04:LTS
From an advisory covering 6 CVEs
 before 0.1+dfsg-2ubuntu0.2+esm1, plus listed versions
0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.2
0.1+dfsg-2ubuntu0.2+esm1
rlottie
Ubuntu:Pro:24.04:LTS
From an advisory covering 6 CVEs
 before 0.1+dfsg-4ubuntu1.1+esm1, plus listed versions
0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.1
0.1+dfsg-4ubuntu1.1+esm1
rlottie
Ubuntu:Pro:26.04:LTS
From an advisory covering 6 CVEs
 before 0.1+dfsg-4.3ubuntu0.1~esm1, plus listed versions
0.1+dfsg-4.20.1+dfsg-4.3
0.1+dfsg-4.3ubuntu0.1~esm1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47319 is a medium vulnerability (CVSS 6.1) in Samsung Open Source Rlottie, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in rlottie 0.1+dfsg-4+deb12u2.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open