EUVD-2026-34233
GHSA-5j7g-c464-cj57
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.
AnalysisAI
Uncontrolled memory allocation in Samsung Open Source rlottie allows a local attacker to trigger excessive heap allocation by supplying a crafted Lottie animation file containing polygon or polystar shape elements with arbitrarily large point counts. Affected are all rlottie versions prior to commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd. An attacker who can cause a user to open a malicious .lottie or .json animation - in any application embedding the rlottie library - can achieve a high-severity denial-of-service and a minor integrity impact, consistent with the CVSS A:H/I:L scoring. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Technical ContextAI
rlottie is an open-source C++ library by Samsung (cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) that renders Lottie animation files - a JSON-based vector animation format - widely embedded in mobile apps, smart TV UIs, and desktop frameworks. The vulnerable code resides in src/vector/vpath.cpp within the VPath::VPathData::addPolystar() and VPath::VPathData::addPolygon() methods. Both functions accept a floating-point points parameter that governs how many vertices are computed and allocated for polygon/polystar shapes. Prior to the fix, no upper bound was enforced on this value, mapping directly to CWE-789 (Memory Allocation with Excessive Size Value): the library trusts attacker-controlled input from an animation file to size heap allocations without validation. The fix (PR #588) caps points at a hard maximum of 1024.0f in both code paths before any allocation occurs.
RemediationAI
The upstream fix is available as GitHub PR #588 (https://github.com/Samsung/rlottie/pull/588), which introduces a compile-time constant MAX_POLY_POINTS = 1024.0f and clamps the points parameter in both addPolystar() and addPolygon() before allocation. Projects consuming rlottie as a vendored dependency should cherry-pick commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd into their build; a tagged release version incorporating this fix has not been independently confirmed from available data. As a compensating control where patching is not immediately feasible, restrict the application's ability to load Lottie animation files from untrusted or external sources - for example, whitelist animation assets to bundled, verified resources only, or add an application-layer schema validation step that rejects polygon/polystar elements with point counts exceeding a safe threshold (e.g., 1024) before passing the file to rlottie. This workaround adds parsing overhead and requires maintaining the validation logic separately from the library.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today