What is the CVSS score of CVE-2026-47318?

CVE-2026-47318 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

rlottie CVE-2026-47318

EUVD-2026-34237 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-04 samsung.tv_appliance

GHSA-r436-q6wh-rcxr

Stack Overflow Samsung Buffer Overflow

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:23 vuln.today

Analysis Generated

Jun 04, 2026 - 10:23 vuln.today

DescriptionCVE.org

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

AnalysisAI

Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local attacker, via a crafted Lottie animation file, to crash the embedding application or potentially corrupt stack memory. The vulnerable code in gray_render_cubic (src/vector/freetype/v_ft_raster.cpp) subdivides Bezier curves onto a fixed-size bez_stack (capacity 32×3+1 vectors) without a depth guard, so a pathologically complex curve exhausts the buffer. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

rlottie is a Samsung Open Source C++ library that renders Lottie animation files (JSON-based vector graphics) and is embedded in Samsung TV OS and numerous third-party applications. The vulnerable component (src/vector/freetype/v_ft_raster.cpp) is adapted from the FreeType font rasterizer and implements Bezier curve subdivision using a fixed-size stack array bez_stack (capacity: 32×3+1 SW_FT_Vector entries). The gray_render_cubic function recursively subdivides cubic Bezier curves into this array; without bounds validation, a curve requiring more than 31 subdivision levels writes past the end of the stack buffer. The upstream fix (PR #582) inserts the guard if (arc - ras.bez_stack >= 31 * 3) return; before each subdivision step. CWE-121 (Stack-based Buffer Overflow) identifies the root cause class. CPE cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:* confirms all versions prior to the fix commit are affected.

RemediationAI

Update the rlottie dependency to a version incorporating commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035 or later, which adds the bounds check if (arc - ras.bez_stack >= 31 * 3) return; in gray_render_cubic. The fix is available via GitHub PR #582 (https://github.com/Samsung/rlottie/pull/582); a formally tagged release version incorporating this commit is not independently confirmed from the available data - downstream maintainers should cherry-pick the commit into their vendored copy or track the upstream repository for a tagged release. As a compensating control where patching is not immediately possible, applications accepting Lottie files from untrusted sources should run the rlottie renderer in an isolated sandboxed process (e.g., a seccomp-restricted worker or separate container), so that a triggered overflow results in a contained subprocess crash rather than compromising the parent application. Additionally, input validation at the application boundary to reject abnormally large or deeply nested Lottie JSON structures can reduce the attack surface, though this requires application-specific tuning.