What is the CVSS score of CVE-2026-15551?

CVE-2026-15551 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Samsung rlottie CVE-2026-15551

EUVD-2026-43257 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-13 samsung.tv_appliance

GHSA-h37q-3gh3-x72p

Integer Overflow Samsung Buffer Overflow Rlottie

5.5

CVSS 3.1 · Vendor: samsung.tv_appliance

Severity by source

Vendor (samsung.tv_appliance) PRIMARY

5.5 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

vuln.today AI

5.5 MEDIUM

Local file-parsing vector, high complexity for reliable overflow, low privileges and user interaction required, primary impact is availability via crash.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung.tv_appliance).

CVSS VectorVendor: samsung.tv_appliance

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 00:45 vuln.today

DescriptionCVE.org

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

This issue affects .

AnalysisAI

Integer overflow in Samsung's open-source rlottie animation rendering library leads to buffer overflow, with high availability impact including potential crash or memory corruption. Exploitation requires local access, low privileges, user interaction, and high attack complexity, making this a lower-urgency finding despite the buffer overflow class. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog. The upstream fix is available as a GitHub pull request (#595), though a formally tagged patched release version has not been independently confirmed.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie animations, which are JSON-based vector animation files widely used in mobile and TV applications. CWE-190 (Integer Overflow or Wraparound) describes a class of defect where arithmetic operations on integer types produce values exceeding the representable range, causing the result to wrap around to an unexpectedly small or negative value. In this context, such a wrap-around likely defeats a size or bounds check during parsing or rasterization of animation data, subsequently allowing a write beyond the intended buffer boundary - the classic CWE-190 → buffer overflow chain. Because rlottie processes untrusted animation files, the attack surface is wherever the library parses externally-supplied Lottie content.

RemediationAI

Apply the upstream fix available in Samsung rlottie GitHub pull request #595 (https://github.com/Samsung/rlottie/pull/595). Note that this is an upstream PR/commit fix; a formally tagged patched release version has not been independently confirmed from the available data, so downstream consumers should monitor the rlottie repository for an official tagged release. Projects that vendor or bundle rlottie should update their vendored copy once a release is confirmed. As a compensating control, restrict the processing of untrusted or externally-sourced Lottie animation files in applications embedding rlottie, particularly in contexts where the rendering pipeline runs with elevated privileges. Sandboxing the rlottie rendering process (e.g., using OS-level process isolation or seccomp profiles on Linux) would limit the blast radius of any exploitation to a crash rather than broader system impact. No other vendor advisory beyond the GitHub PR was identified.