The vulnerability identified as CVE-2026-47320 in Samsung Open Source rlottie is caused by access to an uninitialized pointer combined with uncontrolled recursion. This can result in pointer manipulation and processing of oversized serialized data payloads, potentially impacting application availability. The issue affects rlottie versions prior to the commit eae37633fda13ac05b25c6c95aacea4bc33c80a3. The CVSS 3.1 base score is 6.1 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, indicating local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No patch or official remediation level has been published by Samsung Open Source at this time.

The vulnerability can lead to pointer manipulation and denial of service through availability impact due to uncontrolled recursion and uninitialized pointer access. There is no confidentiality impact, and integrity impact is low. The attack requires local access and user interaction, limiting the attack surface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.