How severe is CVE-2026-18772?

CVE-2026-18772 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-18772 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-18772?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-18772 published?

CVE-2026-18772 was published on 2026-08-04 and last updated on 2026-08-18.

CVE-2026-18772

CVE-2026-18772 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1325.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1325
Published: 2026-08-04
Last modified: 2026-08-18

Description

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

Frequently asked questions

What is CVE-2026-18772?: Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.
How severe is CVE-2026-18772?: CVE-2026-18772 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-18772 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-18772?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-18772 published?: CVE-2026-18772 was published on 2026-08-04 and last updated on 2026-08-18.

References

https://github.com/Samsung/rlottie/pull/596

Other CWE-1325 vulnerabilities

CVE-2024-27796 — High (CVSS 7.8): The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
CVE-2026-34183 — High (CVSS 7.5): Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing…
CVE-2025-2240 — High (CVSS 7.5): A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This…
CVE-2026-54081 — Medium (CVSS 6.9): veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a…
CVE-2026-54080 — Medium (CVSS 6.9): veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a…
CVE-2026-13056 — Medium (CVSS 6.5): Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate…

Browse all CWE-1325 vulnerabilities →