This vulnerability (CVE-2026-47319) in Samsung Open Source rlottie involves improper handling of memory allocation requests with excessively large size values, classified under CWE-789. It allows an attacker with local access and user interaction to cause excessive memory allocation, which can lead to denial of service conditions. The issue affects rlottie versions prior to commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd. The CVSS 3.1 base score is 6.1, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There is no vendor advisory or patch link currently available, and no known exploits in the wild.

The vulnerability can be exploited by a local attacker with low privileges who can induce the application to allocate excessive memory. This can lead to denial of service by exhausting system resources, impacting availability. There is no impact on confidentiality and only low impact on integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to affected rlottie instances to trusted users and monitor for unusual memory usage patterns. Avoid executing untrusted code that may trigger this vulnerability.