EUVD-2026-34236
GHSA-c464-p6xp-r3mm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.
This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.
AnalysisAI
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-delivered malicious Lottie animation file to crash the host application by triggering infinite recursive resolution of circular precomposition asset references during parsing. The CVSS vector (AV:L/UI:R/A:H) confirms the primary impact is high availability loss - a stack overflow - with no confidentiality exposure despite the 'Information Disclosure' tag in source metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is a Samsung Open Source C++ library for rendering Lottie vector animations encoded as JSON. The vulnerable code resides in src/lottie/lottieparser.cpp, where the parser resolves precomposition (precomp) layer references via the mPreCompRefId field in layer objects. CWE-674 (Uncontrolled Recursion) describes the root cause: before fix commit e2d19e3b, no cycle detection existed in the asset dependency graph, so a crafted animation containing circular references - asset A pointing to asset B which points back to asset A - caused the parser to recurse indefinitely until the call stack was exhausted. The fix introduced in PR #585 implements a BFS traversal using std::unordered_set and std::queue to build a directed dependency graph across all precomp assets and detect cycles before processing, emitting a warning and skipping any asset identified as part of a cycle.
RemediationAI
The upstream fix is available via GitHub PR #585 (https://github.com/Samsung/rlottie/pull/585); organizations should update their rlottie dependency to a build that includes commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 or any subsequent commit. A tagged release version independently confirmed to include this fix has not been identified - verify the fix commit is present in your build artifact before declaring remediation complete. As a compensating control where immediate patching is not feasible, restrict Lottie animation file ingestion to sources validated as trusted and non-user-supplied; this eliminates the attacker-controlled file delivery prerequisite. Sandboxing the rlottie rendering process in a dedicated subprocess or container limits the availability impact of a triggered crash to that subprocess rather than the host application, at the cost of additional IPC overhead. Stack size limits at the OS or thread level may reduce the time-to-crash window but will not prevent exploitation.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today