CVE-2026-10305: Medium severity rLottie vulnerability
Published Jun 4, 2026
·Updated
Last updated 20 July 2026
Other sources
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
— Launchpad
Affected Software
2 affected componentsFixes available
rLottie<223a2a41ba4f462e4abe767bebba49a366c9b9fd
debian/rlottie<=0.1+dfsg-2
0.1+dfsg-2+deb11u20.1+dfsg-4+deb12u20.1+dfsg-4.2+deb13u20.1+dfsg-5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rlottieto a version that resolves this vulnerability.Fixed in 0.1+dfsg-2+deb11u2Fixed in 0.1+dfsg-4+deb12u2Fixed in 0.1+dfsg-4.2+deb13u2Fixed in 0.1+dfsg-5 - Upgrade
Upgrade
Samsung Open Source rlottieto a version that resolves this vulnerability.Fixed in 223a2a41ba4f462e4abe767bebba49a366c9b9fd
Event History
Jun 4, 2026
CVE Published
via MITRE·09:40 AM
Data Sourced
via MITRE·09:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Jul 21, 2026
Data Sourced
via Ubuntu·04:09 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·04:11 PM
DescriptionAffected Software
Data Sourced
via Launchpad·04:11 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-10305?
The severity of CVE-2026-10305 is medium with a CVSS score of 6.1.
2
How do I fix CVE-2026-10305?
To fix CVE-2026-10305, update the rlottie software to a version after commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
3
What software is affected by CVE-2026-10305?
CVE-2026-10305 affects the Samsung Open Source rlottie library.
4
What type of vulnerability is CVE-2026-10305?
CVE-2026-10305 is an out-of-bounds read vulnerability that can lead to buffer overreads.
5
When was CVE-2026-10305 published?
CVE-2026-10305 was published on June 4, 2026.