Samsung rlottie CVE-2026-8916

Exploitation requires two concrete prerequisites confirmed by the CVSS vector: (1) local access - the attacker must be able to place or deliver a crafted Lottie animation file to the victim's system or platform (AV:L), and (2) user interaction - a user must explicitly open, render, or play the malicious animation file in an application embedding the vulnerable rlottie library (UI:R). The vulnerability is triggered specifically when rlottie processes a Lottie animation whose total contour count or point count in path geometry exceeds 32,767, causing the short field truncation. No authentication is required from the attacker's perspective (PR:N). Exploitation is limited by: the local attack vector ruling out remote network delivery without a separate delivery mechanism; the user interaction requirement preventing silent background exploitation; and the scope being unchanged (S:U), meaning a successful exploit cannot escape the application's privilege boundary to affect other system components.

CVSS 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H reflects a locally-exploitable, user-interaction-dependent vulnerability with no confidentiality impact. The local attack vector (AV:L) significantly limits network-based opportunistic exploitation. User interaction (UI:R) means an attacker cannot silently exploit this - a user must open or render a crafted animation file. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. No KEV listing exists, meaning CISA has not confirmed active exploitation. No public exploit code has been identified at time of analysis. Despite PR:N (no privileges required), the combination of AV:L and UI:R makes mass automated exploitation unlikely; realistic risk is targeted attack via malicious file delivery to users of rlottie-embedded applications. The high availability impact (A:H) suggests reliable crash potential once triggered, which is consistent with integer truncation causing wild pointer dereferences in the rasterizer.

An attacker crafts a malicious Lottie JSON animation file containing path data with contour or point counts exceeding 32,767 - the maximum value of a signed 16-bit short integer. The file is delivered to a victim (via email attachment, web download, or embedded in content on a Samsung TV platform) and the user opens or plays it in an rlottie-based application. The truncated short values corrupt pointer arithmetic in the FreeType rasterizer's ft_stroke_border_export() function, producing an out-of-bounds write that crashes the application or, in a less controlled scenario, corrupts adjacent memory structures.