What is the CVSS score of CVE-2026-47306?

CVE-2026-47306 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

rlottie CVE-2026-47306

EUVD-2026-34236 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-06-04 samsung.tv_appliance

GHSA-c464-p6xp-r3mm

Information Disclosure Samsung

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:24 vuln.today

Analysis Generated

Jun 04, 2026 - 10:24 vuln.today

DescriptionCVE.org

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.

This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

AnalysisAI

Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-delivered malicious Lottie animation file to crash the host application by triggering infinite recursive resolution of circular precomposition asset references during parsing. The CVSS vector (AV:L/UI:R/A:H) confirms the primary impact is high availability loss - a stack overflow - with no confidentiality exposure despite the 'Information Disclosure' tag in source metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is a Samsung Open Source C++ library for rendering Lottie vector animations encoded as JSON. The vulnerable code resides in src/lottie/lottieparser.cpp, where the parser resolves precomposition (precomp) layer references via the mPreCompRefId field in layer objects. CWE-674 (Uncontrolled Recursion) describes the root cause: before fix commit e2d19e3b, no cycle detection existed in the asset dependency graph, so a crafted animation containing circular references - asset A pointing to asset B which points back to asset A - caused the parser to recurse indefinitely until the call stack was exhausted. The fix introduced in PR #585 implements a BFS traversal using std::unordered_set and std::queue to build a directed dependency graph across all precomp assets and detect cycles before processing, emitting a warning and skipping any asset identified as part of a cycle.

RemediationAI

The upstream fix is available via GitHub PR #585 (https://github.com/Samsung/rlottie/pull/585); organizations should update their rlottie dependency to a build that includes commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 or any subsequent commit. A tagged release version independently confirmed to include this fix has not been identified - verify the fix commit is present in your build artifact before declaring remediation complete. As a compensating control where immediate patching is not feasible, restrict Lottie animation file ingestion to sources validated as trusted and non-user-supplied; this eliminates the attacker-controlled file delivery prerequisite. Sandboxing the rlottie rendering process in a dedicated subprocess or container limits the availability impact of a triggered crash to that subprocess rather than the host application, at the cost of additional IPC overhead. Stack size limits at the OS or thread level may reduce the time-to-crash window but will not prevent exploitation.