CVE-2026-82797
Description
A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service (DoS) by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data.
Statement
The rlottie library is shipped in Fedora and EPEL community distributions. The uncontrolled recursion vulnerability can be triggered by processing specially crafted serialized data with nested payloads, leading to a denial of service.
Mitigation
Update rlottie to a version that includes the upstream fix commit 8de0d9e6ca80ffef654965505981727b9fa06a51.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Exploitation of this weakness can leave the application in an unexpected state and cause variables to be reassigned before the first invocation has completed. This may eventually result in memory corruption or unexpected code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
