EUVD-2026-55952
GHSA-67hf-hjhx-qv73
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Malicious file is network-deliverable with no auth (PR:N), but a user or process must render it (UI:R); impact is purely availability with no confidentiality or integrity effect.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.
AnalysisAI
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows an unauthenticated remote attacker to crash or hang any application embedding the library by supplying a specially crafted Lottie animation file. The vulnerability stems from missing input-quantity validation across four distinct code paths - precomposition nesting depth, global render-node budgets, Repeater element copy counts, and polystar/polygon point values - each capable of triggering unbounded recursion or resource exhaustion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application embeds the rlottie library and renders Lottie animation content that is influenced by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately characterizes a remotely deliverable, low-complexity DoS requiring only that a user or automated pipeline render a malicious Lottie file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a Lottie JSON animation file containing precomposition layers nested beyond 32 levels or a Repeater element with a non-finite copy count, then delivers it to a target via a malicious website, a compromised content-delivery source, or a file upload endpoint. When the target application passes the file to rlottie for rendering - triggered by user action or automated content loading - the missing depth and budget guards cause a stack overflow or extreme resource exhaustion, crashing or hanging the host process. … |
| Remediation | The upstream fix is available in GitHub PR #596 at https://github.com/Samsung/rlottie/pull/596; however, because this is a pull request rather than a tagged release, a formally released patched version has not been independently confirmed - monitor the Samsung/rlottie repository for an official release or apply the patch manually against the four modified files (lottieitem.cpp, lottieitem.h, lottiemodel.cpp, lottiemodel.h, vpath.cpp). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today