The vulnerability in rlottie involves access of an uninitialized pointer combined with uncontrolled recursion, which allows manipulation of pointers and handling of oversized serialized data payloads. This can lead to a denial of service condition by exhausting resources or causing application crashes. The issue affects rlottie versions before the commit eae37633fda13ac05b25c6c95aacea4bc33c80a3. The CVSS vector indicates low attack complexity, no privileges required, user interaction needed, and impacts availability severely while not affecting confidentiality and only slightly affecting integrity.

The vulnerability primarily impacts availability, potentially causing denial of service through application crashes or resource exhaustion. There is no impact on confidentiality and only limited impact on integrity. No known exploits have been reported in the wild, reducing immediate risk but the vulnerability remains exploitable under certain conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates. Until a patch is available, avoid processing untrusted serialized data with affected rlottie versions to mitigate risk.