UBUNTU-CVE-2026-47318: Buffer Overflow

Q: What level of access and interaction are required for exploitation?

The CVSS vector indicates local access is required, no privileges are required, and user interaction is required. The available data does not specify the exact user action or input that triggers the overflow.

Q: Which rlottie versions are affected?

The issue affects rlottie versions before commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035. No Ubuntu package version or fixed package version is provided in the available data.

Q: What is the likely security impact if exploited?

The stated CVSS vector indicates no confidentiality impact, low integrity impact, and high availability impact. This means exploitation may alter data to a limited extent and can cause significant denial of service.

Published Jun 4, 2026

Updated

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

Affected Software

5 affected componentsFixes available

ubuntu/rlottie*

ubuntu/rlottie<0.1+dfsg-2ubuntu0.2+esm1

0.1+dfsg-2ubuntu0.2+esm1

ubuntu/rlottie<0.1+dfsg-4ubuntu1.1+esm1

0.1+dfsg-4ubuntu1.1+esm1

ubuntu/rlottie*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/rlottie to a version that resolves this vulnerability.
Fixed in 0.1+dfsg-2ubuntu0.2+esm1
Upgrade
Upgrade ubuntu/rlottie to a version that resolves this vulnerability.
Fixed in 0.1+dfsg-4ubuntu1.1+esm1

Event History

Jun 4, 2026

CVE Published

via OSV·10:16 AM

Data Sourced

via OSV·10:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access and interaction are required for exploitation?

The CVSS vector indicates local access is required, no privileges are required, and user interaction is required. The available data does not specify the exact user action or input that triggers the overflow.

Which rlottie versions are affected?

The issue affects rlottie versions before commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035. No Ubuntu package version or fixed package version is provided in the available data.

What is the likely security impact if exploited?

The stated CVSS vector indicates no confidentiality impact, low integrity impact, and high availability impact. This means exploitation may alter data to a limited extent and can cause significant denial of service.

UBUNTU-CVE-2026-47318: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access and interaction are required for exploitation?

Which rlottie versions are affected?

What is the likely security impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

What level of access and interaction are required for exploitation?

Which rlottie versions are affected?

What is the likely security impact if exploited?