CVE-2026-47319

NameCVE-2026-47319
DescriptionMemory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4675-1
Debian Bugs1138919

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rlottie (PTS)bookworm0.1+dfsg-4+deb12u2fixed
trixie0.1+dfsg-4.2+deb13u2fixed
forky, sid0.1+dfsg-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rlottiesourcebullseye0.1+dfsg-2+deb11u2DLA-4675-1
rlottiesourcebookworm0.1+dfsg-4+deb12u2
rlottiesourcetrixie0.1+dfsg-4.2+deb13u2
rlottiesource(unstable)0.1+dfsg-51138919

Notes

https://github.com/Samsung/rlottie/pull/588
https://github.com/Samsung/rlottie/commit/5def9f402b1cb5b09f52655e414f0afba4ffd959
Search for package or bug name: Reporting problems