The vulnerability identified as CVE-2026-47306 in Samsung Open Source rlottie is due to uncontrolled recursion caused by processing oversized serialized data payloads. This can lead to a denial of service condition by exhausting system resources. The affected versions include all versions prior to the commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945. The CVSS v3.1 base score is 6.1, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No official remediation or patch has been published yet, and no exploits are known in the wild.

Successful exploitation of this vulnerability can cause a denial of service by triggering uncontrolled recursion through oversized serialized data payloads. This impacts the availability of the affected system or application using rlottie. There is no reported impact on confidentiality or significant integrity loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or oversized serialized data payloads with rlottie. Monitor vendor channels for updates regarding patches or mitigations.