What is the CVSS score of CVE-2026-49510?

CVE-2026-49510 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

rlottie CVE-2026-49510

EUVD-2026-34235 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-06-04 samsung.tv_appliance

GHSA-fxgp-4mch-4c5h

Samsung Integer Overflow Buffer Overflow

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:21 vuln.today

Analysis Generated

Jun 04, 2026 - 10:21 vuln.today

DescriptionCVE.org

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.

This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.

AnalysisAI

Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corruption, resulting in high availability impact and low integrity impact on the rendering application. Specifically affecting the gradient color-stop parsing logic in lottiemodel.cpp, the flaw arises when a malformed colorPoints value causes a signed integer multiplication to overflow before being assigned to a size_t, producing an undersized buffer computation. No active exploitation has been identified at time of analysis, and a fix is available upstream via GitHub PR #592, though a formally tagged release version has not been independently confirmed.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie vector animation files, widely embedded in Samsung appliance UIs and other consumer applications. The root cause is CWE-190 (Integer Overflow or Wraparound): in src/lottie/lottiemodel.cpp, the expression size_t colorPointsSize = colorPoints * 4 performed the multiplication using the signed int type of colorPoints before assigning to size_t. A sufficiently large attacker-controlled colorPoints value causes the signed multiplication to overflow and wrap to a small or negative value, which is then silently cast to size_t, yielding a drastically undersized colorPointsSize. The fix in PR #592 restructures the check to (size_t)colorPoints > size / 4 to detect overflow before the multiplication, and separately handles the legacy bodymovin negative-colorPoints code path. The tags also reference Buffer Overflow, suggesting the undersized size computation likely enables a downstream buffer over-read or out-of-bounds write during gradient stop population.

RemediationAI

The primary fix is to update rlottie to a build incorporating commit 21292665023e5074b38254432716866d00f1985f or the changes merged via GitHub PR #592 (https://github.com/Samsung/rlottie/pull/592). Note that this is an upstream commit/PR reference, not a formally tagged release - the exact released version number has not been independently confirmed from available data. Downstream maintainers packaging rlottie should verify whether their packaged version includes this commit and release an updated package accordingly. As a compensating control where patching is not immediately possible, applications can restrict or sandbox the file types and sources from which Lottie animations are loaded, rejecting untrusted or externally-sourced .json/.lottie files at the application boundary. This reduces attack surface but does not eliminate the underlying flaw. No vendor advisory URL beyond the GitHub PR was provided in the input data.