CVE catalog

CVE-2025-53074

rlottie vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrlottiesid0.1+dfsg-5fixed
Debianrlottieforky0.1+dfsg-5fixed
Debianrlottietrixie0.1+dfsg-4.2+deb13u2fixed
Debianrlottiebookworm0.1+dfsg-4+deb12u2fixed
Ubunturlottienoble0.1+dfsg-4ubuntu1.1fixed
Ubuntulibrlottie-devnoble0.1+dfsg-4ubuntu1.1fixed
Ubuntulibrlottie0-1noble0.1+dfsg-4ubuntu1.1fixed
Ubunturlottiepro0~git20190721.24346d0+dfsg-2vulnerable
Ubunturlottiepro0~git20190721.24346d0+dfsg-2build1vulnerable
Ubunturlottiepro0~git20200305.a717479+dfsg-1vulnerable
Ubunturlottiepro0~git20200305.a717479+dfsg-1ubuntu0.1~esm1vulnerable
Ubunturlottiepro0~git20200305.a717479+dfsg-1ubuntu0.1~esm2fixed
Ubunturlottie22.040.1+dfsg-2vulnerable
Ubunturlottie22.040.1+dfsg-2ubuntu0.1vulnerable
Ubunturlottie22.040.1+dfsg-2ubuntu0.2fixed
Ubunturlottie24.040.1+dfsg-4ubuntu1vulnerable
Ubunturlottie24.040.1+dfsg-4ubuntu1.1fixed
Ubunturlottie25.100.1+dfsg-4.2vulnerable
Ubunturlottie25.100.1+dfsg-4.2ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrlottiesourcesid0.1+dfsg-4.3not yet assignedNot reported[1109341]
Debianrlottiesourceforky0.1+dfsg-4.3not yet assignedNot reported[1109341]
Debianrlottiesourcetrixie0.1+dfsg-4.2+deb13u1not yet assignedNot reported[1109341]
Debianrlottiesourcebookworm0.1+dfsg-4+deb12u1not yet assignedNot reported[1109341]
Ubunturlottiedebnoble0.1+dfsg-4ubuntu1.1Not reportedNot reportedNot reported
Ubuntulibrlottie-devdebnoble0.1+dfsg-4ubuntu1.1Not reportedNot reportedNot reported
Ubuntulibrlottie0-1debnoble0.1+dfsg-4ubuntu1.1Not reportedNot reportedNot reported
Ubunturlottiedebpro0~git20200305.a717479+dfsg-1ubuntu0.1~esm2Not reportedUBUNTU-CVE-2025-53074Not reported
Ubunturlottiedeb22.040.1+dfsg-2ubuntu0.2Not reportedUBUNTU-CVE-2025-53074Not reported
Ubunturlottiedeb24.040.1+dfsg-4ubuntu1.1Not reportedUBUNTU-CVE-2025-53074Not reported
Ubunturlottiedeb25.100.1+dfsg-4.2ubuntu0.1Not reportedUBUNTU-CVE-2025-53074Not reported

[Debian bug #1109341]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [librlottie0-1]Fixed

    Source package: [rlottie]

    Details (2)

    • 0.1+dfsg-4+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.1+dfsg-4+deb12u1

      usn · rlottie · debian · bookworm; usn · rlottie · debian · 12

    • 0.1+dfsg-4+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.1+dfsg-4+deb12u1

      usn · rlottie · debian · bookworm; usn · rlottie · debian · 12

  • [librlottie-dev]Fixed

    Source package: [rlottie]

    Details (2)

    • 0.1+dfsg-4+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.1+dfsg-4+deb12u1

      usn · rlottie · debian · bookworm; usn · rlottie · debian · 12

    • 0.1+dfsg-4+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.1+dfsg-4+deb12u1

      usn · rlottie · debian · bookworm; usn · rlottie · debian · 12

[Debian 13 (Trixie)]

  • [librlottie0-1]Fixed

    Source package: [rlottie]

    Details (2)

    • 0.1+dfsg-4.2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 0.1+dfsg-4.2+deb13u1

      usn · rlottie · debian · 13

    • 0.1+dfsg-4.2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 0.1+dfsg-4.2+deb13u1

      usn · rlottie · debian · 13

  • [librlottie-dev]Fixed

    Source package: [rlottie]

    Details (2)

    • 0.1+dfsg-4.2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 0.1+dfsg-4.2+deb13u1

      usn · rlottie · debian · 13

    • 0.1+dfsg-4.2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 0.1+dfsg-4.2+deb13u1

      usn · rlottie · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]