EUVD-2026-34234
GHSA-5x26-gpfr-f429
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
AnalysisAI
Out-of-bounds read in Samsung's rlottie rendering library prior to commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd allows a local attacker to crash the rendering process (high availability impact) or cause low-level integrity corruption by supplying a crafted Lottie animation file. Two distinct code paths are affected: signed integer overflow in FreeType raster bit-shift macros and a missing zero-stopCount guard in gradient color table generation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but the wide embedding of rlottie in Samsung consumer devices (TVs, appliances) represents a meaningful aggregate exposure.
Technical ContextAI
rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie vector animations. The root cause (CWE-125: Out-of-bounds Read) manifests in two separate locations exposed by PR #587. First, in src/vector/freetype/v_ft_raster.cpp, the macros SUBPIXELS, UPSCALE, DOWNSCALE, and SCALED performed left bit-shifts on signed TPos integers without an unsigned cast; signed integer left-shift overflow is undefined behavior in C/C++ and can produce incorrect pointer arithmetic or buffer size calculations, enabling reads beyond allocated raster buffers. The fix wraps operands with (unsigned long) before the shift. Second, in src/vector/vdrawhelper.cpp, the generateGradientColorTable function iterated with the condition i < stopCount - 1; when stopCount is zero and the type is unsigned, this underflows to a very large value, causing the loop to read far past the color stops array. The fix adds an explicit zero-stopCount early-return guard and rewrites the loop condition to i + 1 < stopCount to eliminate the underflow. Both flaws are reachable through attacker-controlled Lottie file content during animation rendering.
RemediationAI
The upstream fix is available via GitHub PR #587 at https://github.com/Samsung/rlottie/pull/587, targeting commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd. The patch modifies src/vector/freetype/v_ft_raster.cpp to add (unsigned long) casts in the SUBPIXELS, UPSCALE, DOWNSCALE, and SCALED macros, and modifies src/vector/vdrawhelper.cpp to add a zero-stopCount early return and fix the loop boundary condition in generateGradientColorTable. This is an upstream fix available via PR/commit; a formally tagged release version has not been independently confirmed at time of analysis - consumers should monitor the Samsung/rlottie repository at https://github.com/Samsung/rlottie for a tagged release and apply the fix commit directly in the interim. As a compensating control, applications can validate Lottie input files prior to rendering - specifically rejecting animations with zero gradient stops or extreme raster coordinate values - though this requires Lottie format parsing logic and does not eliminate all vulnerable code paths. Running the rlottie rendering pipeline in a sandboxed process (e.g., seccomp-restricted subprocess) limits a successful exploit to the rendering context and prevents escalation to the host application; the trade-off is added IPC latency and implementation complexity.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today