CVE-2026-10305 is classified as a CWE-125 out-of-bounds read vulnerability in the Samsung Open Source rlottie library. It allows an attacker to cause buffer overread conditions by accessing memory outside the allocated bounds. The issue affects all versions of rlottie prior to the specified commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd. The CVSS 3.1 base score is 6.1, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No vendor advisory or patch information is currently available.

The vulnerability can lead to out-of-bounds memory reads, which may cause application crashes or instability, impacting availability. There is no indication of confidentiality loss or significant integrity impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Samsung Open Source regarding rlottie. Avoid running untrusted code that uses the vulnerable rlottie versions and limit local access to trusted users to reduce risk.