EUVD-2026-34235
GHSA-fxgp-4mch-4c5h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
AnalysisAI
Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corruption, resulting in high availability impact and low integrity impact on the rendering application. Specifically affecting the gradient color-stop parsing logic in lottiemodel.cpp, the flaw arises when a malformed colorPoints value causes a signed integer multiplication to overflow before being assigned to a size_t, producing an undersized buffer computation. No active exploitation has been identified at time of analysis, and a fix is available upstream via GitHub PR #592, though a formally tagged release version has not been independently confirmed.
Technical ContextAI
rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie vector animation files, widely embedded in Samsung appliance UIs and other consumer applications. The root cause is CWE-190 (Integer Overflow or Wraparound): in src/lottie/lottiemodel.cpp, the expression size_t colorPointsSize = colorPoints * 4 performed the multiplication using the signed int type of colorPoints before assigning to size_t. A sufficiently large attacker-controlled colorPoints value causes the signed multiplication to overflow and wrap to a small or negative value, which is then silently cast to size_t, yielding a drastically undersized colorPointsSize. The fix in PR #592 restructures the check to (size_t)colorPoints > size / 4 to detect overflow before the multiplication, and separately handles the legacy bodymovin negative-colorPoints code path. The tags also reference Buffer Overflow, suggesting the undersized size computation likely enables a downstream buffer over-read or out-of-bounds write during gradient stop population.
RemediationAI
The primary fix is to update rlottie to a build incorporating commit 21292665023e5074b38254432716866d00f1985f or the changes merged via GitHub PR #592 (https://github.com/Samsung/rlottie/pull/592). Note that this is an upstream commit/PR reference, not a formally tagged release - the exact released version number has not been independently confirmed from available data. Downstream maintainers packaging rlottie should verify whether their packaged version includes this commit and release an updated package accordingly. As a compensating control where patching is not immediately possible, applications can restrict or sandbox the file types and sources from which Lottie animations are loaded, rejecting untrusted or externally-sourced .json/.lottie files at the application boundary. This reduces attack surface but does not eliminate the underlying flaw. No vendor advisory URL beyond the GitHub PR was provided in the input data.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today