Samsung rlottie CVE-2026-47319

User interaction is required: a local user or process must open or render a crafted Lottie animation file (.json or .lottie) processed by the vulnerable rlottie library. The vulnerability is triggered specifically within the polygon (addPolygon) or polystar (addPolystar) shape rendering code paths - animations that do not include these shape types are not affected. No authentication or special privileges are required from the attacker's perspective (PR:N), but the attacker must be able to deliver the malicious file to a location where the victim application will load it. Exploitation is limited to denial-of-service and minor integrity impact (no confidentiality breach per CVSS C:N). Non-default or unusual rlottie configurations are not required - the vulnerability exists in standard polygon rendering that is enabled by default.

The CVSS 6.1 (Medium) score reflects a realistic but bounded threat. The attack vector is local (AV:L), meaning exploitation requires the victim's environment to process a crafted file - this is consistent with rlottie's nature as a file-parsing library; the 'local' vector here means the malicious animation must be present on the local filesystem or delivered through a channel that loads it (e.g., a messaging app, web view, or file manager preview). User interaction is required (UI:R), limiting automated exploitation. Privileges are not required (PR:N). The availability impact is high (A:H), confirming the potential for application crash or process exhaustion, while confidentiality impact is none (C:N). Notably, the CVE tags include 'Information Disclosure,' which contradicts the CVSS C:N signal - this appears to be a mislabeled tag; no information disclosure path is evident from the description or the PR diff. EPSS data is not provided. No KEV listing and no confirmed POC exist, placing this in the 'patch when convenient but monitor embedded uses' tier. Applications embedding rlottie in contexts that process untrusted animation files (e.g., chat apps, social media clients, smart TV content pipelines) face the highest realistic risk.

An attacker crafts a malicious Lottie JSON animation file containing a polystar or polygon shape element with a points value set to an astronomically large number (e.g., 1e38). The attacker distributes this file via a messaging platform, email attachment, or malicious website targeting a user whose application (smart TV, mobile app, or desktop client) embeds rlottie for animation rendering. When the user opens or previews the file, rlottie's addPolystar/addPolygon routine attempts to allocate memory proportional to the unclamped point count, exhausting available heap and crashing the host process. No public POC has been identified at time of analysis, but the fix diff makes the attack primitive straightforward to reconstruct.