EUVD-2026-34232
GHSA-gjw3-x488-w5c3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.
This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.
AnalysisAI
Uncontrolled recursion and uninitialized pointer access in Samsung's rlottie animation library allow a locally-delivered malicious Lottie file to crash any host application via stack exhaustion. All rlottie versions prior to commit eae37633fda13ac05b25c6c95aacea4bc33c80a3 are affected; the PR #593 fix confirms cyclic layer parent references in crafted JSON animation payloads as the definitive trigger. No public exploit code has been identified at time of analysis and rlottie is not listed in CISA KEV, though the high availability impact (A:H) makes denial-of-service reliable for applications that accept user-supplied animation content.
Technical ContextAI
rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie animations, a JSON-based vector animation format widely embedded in Samsung smart TV firmware and third-party application frameworks. The vulnerability has two distinct root causes exposed by parsing attacker-controlled Lottie JSON. First, CWE-824 (Access of Uninitialized Pointer): in lottiemodel.h, a missing empty-vector guard in keyframe/property parsing allows reads from an uninitialized memory region, enabling pointer manipulation and potential memory corruption. Second, Uncontrolled Recursion: in renderer::Layer::matrix() within lottieitem.cpp, layer hierarchy traversal follows parent-layer references without a depth bound. A Lottie file encoding a cyclic reference (layer A → parent B → parent A) causes matrix() to recurse infinitely until the call stack is exhausted. The PR #593 fix addresses both: it introduces a depth parameter capped at 64 to break recursion cycles, and adds a vec.empty() guard before keyframe property access.
RemediationAI
The upstream fix is available via GitHub PR #593 (https://github.com/Samsung/rlottie/pull/593) at commit eae37633fda13ac05b25c6c95aacea4bc33c80a3, targeting changes across lottieitem.cpp, lottieitem.h, and lottiemodel.h. Downstream consumers should update their rlottie vendored copy to at least this commit or cherry-pick the three-file patch. A versioned tagged release incorporating these changes has not been independently confirmed at time of analysis, so integrators should track the upstream repository directly. As a compensating control where immediate patching is not feasible, applications can validate incoming Lottie JSON for cyclic layer parent references before passing content to rlottie - this adds pre-parse overhead but eliminates the recursion attack surface. Alternatively, restricting the application to render only internally generated or digitally signed animation content removes the untrusted-input vector entirely, though this may break user-facing animation customization features.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Same weakness CWE-824 – Access of Uninitialized Pointer
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today