What is the CVSS score of CVE-2026-47320?

CVE-2026-47320 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Samsung rlottie CVE-2026-47320

EUVD-2026-34232 MEDIUM

Access of Uninitialized Pointer (CWE-824)

2026-06-04 samsung.tv_appliance

GHSA-gjw3-x488-w5c3

Information Disclosure Memory Corruption Samsung

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:22 vuln.today

Analysis Generated

Jun 04, 2026 - 10:22 vuln.today

DescriptionCVE.org

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.

This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.

AnalysisAI

Uncontrolled recursion and uninitialized pointer access in Samsung's rlottie animation library allow a locally-delivered malicious Lottie file to crash any host application via stack exhaustion. All rlottie versions prior to commit eae37633fda13ac05b25c6c95aacea4bc33c80a3 are affected; the PR #593 fix confirms cyclic layer parent references in crafted JSON animation payloads as the definitive trigger. No public exploit code has been identified at time of analysis and rlottie is not listed in CISA KEV, though the high availability impact (A:H) makes denial-of-service reliable for applications that accept user-supplied animation content.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie animations, a JSON-based vector animation format widely embedded in Samsung smart TV firmware and third-party application frameworks. The vulnerability has two distinct root causes exposed by parsing attacker-controlled Lottie JSON. First, CWE-824 (Access of Uninitialized Pointer): in lottiemodel.h, a missing empty-vector guard in keyframe/property parsing allows reads from an uninitialized memory region, enabling pointer manipulation and potential memory corruption. Second, Uncontrolled Recursion: in renderer::Layer::matrix() within lottieitem.cpp, layer hierarchy traversal follows parent-layer references without a depth bound. A Lottie file encoding a cyclic reference (layer A → parent B → parent A) causes matrix() to recurse infinitely until the call stack is exhausted. The PR #593 fix addresses both: it introduces a depth parameter capped at 64 to break recursion cycles, and adds a vec.empty() guard before keyframe property access.

RemediationAI

The upstream fix is available via GitHub PR #593 (https://github.com/Samsung/rlottie/pull/593) at commit eae37633fda13ac05b25c6c95aacea4bc33c80a3, targeting changes across lottieitem.cpp, lottieitem.h, and lottiemodel.h. Downstream consumers should update their rlottie vendored copy to at least this commit or cherry-pick the three-file patch. A versioned tagged release incorporating these changes has not been independently confirmed at time of analysis, so integrators should track the upstream repository directly. As a compensating control where immediate patching is not feasible, applications can validate incoming Lottie JSON for cyclic layer parent references before passing content to rlottie - this adds pre-parse overhead but eliminates the recursion attack surface. Alternatively, restricting the application to render only internally generated or digitally signed animation content removes the untrusted-input vector entirely, though this may break user-facing animation customization features.