What is the CVSS score of EUVD-2026-34233?

EUVD-2026-34233 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Samsung rlottie EUVD-2026-34233

| CVE-2026-47319 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-06-04 samsung.tv_appliance

GHSA-5j7g-c464-cj57

Information Disclosure Samsung

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:22 vuln.today

Analysis Generated

Jun 04, 2026 - 10:22 vuln.today

DescriptionCVE.org

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

AnalysisAI

Uncontrolled memory allocation in Samsung Open Source rlottie allows a local attacker to trigger excessive heap allocation by supplying a crafted Lottie animation file containing polygon or polystar shape elements with arbitrarily large point counts. Affected are all rlottie versions prior to commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd. An attacker who can cause a user to open a malicious .lottie or .json animation - in any application embedding the rlottie library - can achieve a high-severity denial-of-service and a minor integrity impact, consistent with the CVSS A:H/I:L scoring. No public exploit code exists and no CISA KEV listing is present at time of analysis.

Technical ContextAI

rlottie is an open-source C++ library by Samsung (cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) that renders Lottie animation files - a JSON-based vector animation format - widely embedded in mobile apps, smart TV UIs, and desktop frameworks. The vulnerable code resides in src/vector/vpath.cpp within the VPath::VPathData::addPolystar() and VPath::VPathData::addPolygon() methods. Both functions accept a floating-point points parameter that governs how many vertices are computed and allocated for polygon/polystar shapes. Prior to the fix, no upper bound was enforced on this value, mapping directly to CWE-789 (Memory Allocation with Excessive Size Value): the library trusts attacker-controlled input from an animation file to size heap allocations without validation. The fix (PR #588) caps points at a hard maximum of 1024.0f in both code paths before any allocation occurs.

RemediationAI

The upstream fix is available as GitHub PR #588 (https://github.com/Samsung/rlottie/pull/588), which introduces a compile-time constant MAX_POLY_POINTS = 1024.0f and clamps the points parameter in both addPolystar() and addPolygon() before allocation. Projects consuming rlottie as a vendored dependency should cherry-pick commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd into their build; a tagged release version incorporating this fix has not been independently confirmed from available data. As a compensating control where patching is not immediately feasible, restrict the application's ability to load Lottie animation files from untrusted or external sources - for example, whitelist animation assets to bundled, verified resources only, or add an application-layer schema validation step that rejects polygon/polystar elements with point counts exceeding a safe threshold (e.g., 1024) before passing the file to rlottie. This workaround adds parsing overhead and requires maintaining the validation logic separately from the library.