What is the CVSS score of CVE-2025-53075?

CVE-2025-53075 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Ubuntu are affected by CVE-2025-53075?

Organizations using Improper Input Validation vulnerability in Samsung Open Source rLottie face critical risk from CVE-2025-53075, a input validation vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2025-53075?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Ubuntu CVE-2025-53075

EUVD-2025-19504 CRITICAL

Improper Input Validation (CWE-20)

2025-06-30 PSIRT@samsung.com

Samsung Path Traversal Ubuntu Debian Rlottie

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ubuntu

LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19504

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

CVE Published

Jun 30, 2025 - 02:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.

Analysis

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Rlottie

View all

CVE-2026-19588 MEDIUM This Month

6.5 Aug 12

Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr

CVE-2026-19587 MEDIUM This Month

6.5 Aug 12

Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri

CVE-2025-53076 CRITICAL Act Now

9.8 Jun 30

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti

CVE-2025-0634 CRITICAL Act Now

9.8 Jun 30

Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.

CVE-2025-53074 CRITICAL Act Now

9.1 Jun 30

Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2

CVE-2026-19518 MEDIUM This Month

6.5 Aug 11

Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows

CVE-2026-19517 MEDIUM This Month

6.5 Aug 11

Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T

CVE-2026-18772 MEDIUM This Month

6.5 Aug 04

Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s

CVE-2026-8916 MEDIUM This Month

6.1 Jun 04

Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i

CVE-2026-47318 MEDIUM This Month

6.1 Jun 04

Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att

CVE-2026-47306 MEDIUM This Month

6.1 Jun 04

Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del

CVE-2026-49510 MEDIUM This Month

6.1 Jun 04

Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

Vendor StatusVendor

Ubuntu

Priority: Low

rlottie

Release	Status	Version
plucky	ignored	end of life, was needs-triage
focal	released	0~git20200305.a717479+dfsg-1ubuntu0.1~esm2
jammy	released	0.1+dfsg-2ubuntu0.2
noble	released	0.1+dfsg-4ubuntu1.1
oracular	ignored	end of life, was needs-triage
questing	released	0.1+dfsg-4.2ubuntu0.1
upstream	released	-

USN-8058-1

Debian

Bug #1109341

rlottie

Release	Status	Fixed Version	Urgency
bullseye	fixed	0.1+dfsg-2+deb11u1	-
bullseye (security)	fixed	0.1+dfsg-2+deb11u1	-
bookworm	fixed	0.1+dfsg-4+deb12u1	-
trixie	fixed	0.1+dfsg-4.2+deb13u1	-
forky, sid	fixed	0.1+dfsg-4.3	-
(unstable)	fixed	0.1+dfsg-4.3	-

DLA-4474-1

CVE-2025-53075 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-53075

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Rlottie

Same weakness CWE-20 – Improper Input Validation

Same technique Path Traversal

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code