CVE-2026-47320: Samsung rlottie Uncontrolled Recursion and Uninitialized Pointer Access

CVE-2026-47320 · Severity: medium · CVSS 6.1 · Published 2026-06-04

Samsung's rlottie is an open-source library used to render vector animations (Lottie files) on various platforms, including mobile devices and smart TVs. A vulnerability in how the library handles complex or malformed animation files could allow an attacker to crash applications using the library or potentially manipulate memory. This could lead to service disruptions or application instability if a user is tricked into opening a specially crafted animation file.

Technologies: Samsung Rlottie. Vendors: Samsung.

Quick answers

Is CVE-2026-47320 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47320 being exploited in the wild.
How severe is CVE-2026-47320?
Medium severity, with a CVSS score of 6.1, published 4 June 2026.
Which products and versions are affected?
Samsung Rlottie before eae37633fda13ac05b25c6c95aacea4bc33c80a3.
Is there a fix for CVE-2026-47320?
A patch was published on 2026-06-01: Fixes submitted via GitHub Pull Request 593 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47320 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-47320?
Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability consists of two primary issues within the Samsung rlottie library. First, a missing guard in the Property::value() method in lottiemodel.h allows for an uninitialized or null pointer dereference when animation keyframes are discarded during parsing. Second, the Layer::matrix() method in lottieitem.cpp lacks depth limiting, leading to uncontrolled recursion and potential stack overflow when processing cyclic parent layer references. An attacker can exploit these by providing oversized or malformed serialized data payloads (Lottie files). Exploitation requires a user to open a malicious file (User Interaction: Required) and can result in a Denial of Service (DoS) or limited memory corruption. The issues were addressed by adding empty-frame guards and implementing a recursion depth limit of 64 levels.

Affected products

  • Samsung rlottie before eae37633fda13ac05b25c6c95aacea4bc33c80a3

Timeline

  • 2026-06-01: patched: Fixes submitted via GitHub Pull Request 593
  • 2026-06-04: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.