« Volver al listado

CVE-2026-47320

Estado: AplazadaMedia (6.1)—

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.

This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Samsung — RlottieAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47320",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47320",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-04T12:19:42.336040Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "PSIRT@samsung.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT@samsung.com",
      "affectedData": [
        {
          "vendor": "Samsung Open Source",
          "product": "rlottie",
          "versions": [
            {
              "status": "unaffected",
              "version": "eae37633fda13ac05b25c6c95aacea4bc33c80a3"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-04T10:16:39.323",
  "references": [
    {
      "url": "https://github.com/Samsung/rlottie/pull/593",
      "source": "PSIRT@samsung.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "PSIRT@samsung.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        },
        {
          "lang": "en",
          "value": "CWE-824"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3."
    },
    {
      "lang": "es",
      "value": "Acceso de puntero no inicializado, vulnerabilidad de recursión no controlada en rlottie de código abierto de Samsung permite manipulación de punteros, cargas útiles de datos serializados de tamaño excesivo.\n\nEste problema afecta a rlottie: antes de eae37633fda13ac05b25c6c95aacea4bc33c80a3."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "PSIRT@samsung.com"
}