EUVD-2026-97125
GHSA-c43m-q6qx-m6m9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft Lottie animation with oversized image asset
-
ExploitVictim app loads it via loadFromData()
-
ExecutionUnchecked VBitmap allocation overflows heap
-
ImpactApplication crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application built on Samsung rlottie to parse an attacker-supplied Lottie animation containing an embedded image asset whose dimensions force an oversized VBitmap allocation (the regression test uses 8194x4096), triggering the heap overflow in VBitmap::Impl::reset / the ARGB32 bitmap creation path in vimageloader.cpp. Despite the description's 'Environment Variables' wording, the source evidence shows the real prerequisite is processing a crafted animation/image asset, not environment-variable control. Limiting factors: the CVSS vector is AV:L with UI:R, so the victim must actively load or open the malicious animation locally; impact is confined to availability (crash) with no confidentiality or integrity effect, and only versions at/before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9 (pre-PR #609) are affected. |
| Impact | This is a genuine but modest-severity defect rather than an urgent priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 (Medium) and is internally consistent: a heap-based buffer overflow (CWE-122) reachable only when a user causes an application to load attacker-supplied animation data, yielding availability impact (crash) with no stated confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public exploit is included in the input, so exploitation likelihood signals are absent - this is 'no public exploit identified at time of analysis.' A notable DATA CONFLICT must be flagged: the NVD-style description states the overflow occurs 'via Environment Variables,' but the authoritative source-code evidence (Samsung/rlottie PR #609) shows the real root cause is unchecked VBitmap allocation for an oversized embedded image asset reached through Animation::loadFromData() - the regression test explicitly rejects an 8194x4096 bitmap. The 'Environment Variables' phrasing appears to be boilerplate/mislabeling and should be verified with the vendor; the CVSS AV:L/UI:R metrics align with file/data-processing, not environment-variable manipulation. Because impact is limited to A:H (denial of service) and requires local processing plus user interaction, this is a low-to-moderate real-world priority: patch in the normal cycle, prioritize only where rlottie processes untrusted animation content. |
| Exploit ScenarioDerived | An attacker crafts a malicious Lottie animation embedding an oversized raster image asset (e.g., 8194x4096) and delivers it to a victim (sticker, downloaded file, or web content). When the victim's application renders it via rlottie's loadFromData(), the unchecked VBitmap allocation produces a heap buffer overflow, crashing the application (denial of service). No public exploit code is identified in the provided data; the fix and a regression test exist in PR #609. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.
RemediationAI
Primary fix: apply the upstream change in Samsung rlottie pull request #609 (https://github.com/Samsung/rlottie/pull/609/) - upstream fix available (PR/commit); a released patched version number was not independently confirmed, so consumers should either track the fixed commit or confirm their distribution/vendor carries the backport. The patch adds a zero-size guard in VBitmap::Impl::reset, rejects non-positive width/height, and validates data pointer, width, height and stride (== width*4) after bitmap creation in vimageloader.cpp, so builds can be verified against the included regression test (8194x4096 must return an invalid bitmap). Where patching is not immediately possible, compensating controls target the actual trigger - untrusted embedded image assets inside Lottie animation JSON: (1) pre-screen/parse animation JSON and reject or strip embedded image assets whose width or height exceed a sane limit (e.g. a few thousand pixels) before handing data to Animation::loadFromData(), trading functionality for safety on untrusted content; (2) run rlottie rendering in a sandboxed or resource-capped process (seccomp/AppArmor confinement plus RLIMIT_AS/RLIMIT_DATA) so an out-of-bounds heap write degrades to a contained crash rather than process compromise, at the cost of possible degraded rendering and added engineering complexity; (3) avoid rendering animations from untrusted sources in privileged processes and gate animation loading behind explicit user confirmation, which aligns with the assessed UI:R prerequisite. Because impact is availability-only, prioritise patching the rendering path in TV/appliance firmware update cycles rather than emergency network-facing remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rlottie is Samsung's C++ rendering library for Lottie/Bodymovin vector animations (JSON-based, widely embedded in Samsung/Tizen UI stacks). The defect is a CWE-122 heap-based buffer overflow in the bitmap allocation path: VBitmap::Impl::reset() computes a byte size from width, height and format and passes it to std::make_unique<uint8_t[]>(size64), and the ARGB32_Premultiplied creation path in src/vector/vimageloader.cpp does not validate the resulting bitmap (data pointer, width/height, or stride == width*4) after allocation. For very large image dimensions the size computation and stride expectations diverge from the actual allocation, so subsequent pixel writes run past the end of the heap buffer. The supplied PR #609 diff confirms the root cause and the fix direction: guard against zero-size allocation (size64 ? make_unique : nullptr), reject width/height <= 0, and verify result.data(), width, height and stride before use, with a regression test using 8194x4096 dimensions that must now yield an invalid/empty bitmap. Note that the CVE description's 'via Environment Variables' framing is not supported by the source evidence; the actual trigger is parsing an attacker-supplied animation with an embedded oversized image asset through Animation::loadFromData(). The CPE cpe:2.3:a:samsung_opensource:rlottie:*:*:*:*:*:*:*:* uses a wildcard, so every rlottie build predating the fix is nominally in scope.
Know when Rlottie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local processing of an attacker-supplied animation file (AV:L) requires the victim to load it (UI:R); no privileges needed (PR:N); impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
DescriptionCVE.org
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Exploit-DB