CVE-2026-18772 describes an improperly controlled sequential memory allocation vulnerability in the Samsung Open Source rlottie library. This vulnerability allows exponential data expansion, which can lead to resource exhaustion and denial of service conditions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No affected versions or patch information are provided, and no known exploits have been reported.

The vulnerability can cause denial of service by exhausting system resources through exponential memory allocation. There is no impact on confidentiality or integrity. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted inputs that might trigger the vulnerability and monitor for updates from Samsung Open Source regarding patches or mitigations.