This vulnerability in Samsung Open Source rlottie is characterized by access of an uninitialized pointer and uncontrolled recursion, which can be triggered by oversized serialized data payloads. These conditions enable pointer manipulation that may cause application instability or denial of service. The affected code is present in versions of rlottie prior to the commit identified by eae37633fda13ac05b25c6c95aacea4bc33c80a3. The CVSS v3.1 base score is 6.1, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability can lead to denial of service due to application crashes or instability caused by pointer manipulation and uncontrolled recursion. There is no reported impact on confidentiality, and integrity impact is low. Exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted serialized data with rlottie and consider restricting local access to vulnerable components.