What is the CVSS score of CVE-2026-8916?

CVE-2026-8916 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Samsung rlottie CVE-2026-8916

EUVD-2026-34238 MEDIUM

Out-of-bounds Write (CWE-787)

2026-06-04 samsung.tv_appliance

GHSA-598h-r4p3-q3wf

Memory Corruption Samsung Buffer Overflow

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:21 vuln.today

Analysis Generated

Jun 04, 2026 - 10:21 vuln.today

DescriptionCVE.org

Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.

AnalysisAI

Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger integer truncation in the embedded FreeType rasterizer, causing memory corruption. All rlottie versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635 are affected, spanning any downstream product or platform embedding this library (including Samsung TV and appliance firmware). Exploitation requires local access and user interaction to render a malicious animation, with primary impact being high availability loss (crash/DoS) and limited integrity impact; no public exploit identified at time of analysis and no active exploitation confirmed.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is a Samsung Open Source C++ library for rendering Lottie JSON-based vector animations, embedded in Samsung TV and appliance firmware among other products. The vulnerability (CWE-787: Out-of-bounds Write) resides in the FreeType rasterizer component across three files: v_ft_raster.h, v_ft_stroker.cpp, and vraster.cpp. The root cause is integer width mismatch: fields n_contours and n_points, and the contours pointer array, were typed as short (SW_FT_Short, 16-bit signed, max 32,767). When processing complex Lottie animations whose contour or point counts exceed this limit, the values are silently truncated, causing incorrect pointer arithmetic in ft_stroke_border_export() and out-of-bounds writes into the outline buffer. The PR diff confirms the fix is a straightforward type widening: short/SW_FT_Short → int/SW_FT_Int across all relevant fields and casts, eliminating the truncation path.

RemediationAI

Upgrade to the rlottie build containing commit dcfde72eae1b0464dc0dd760aec00ada6a148635, available via the upstream fix at https://github.com/Samsung/rlottie/pull/589. Note that no independently confirmed tagged release version is associated with this fix - the patch exists as a merged PR/commit, and a specific release version has not been confirmed in the available data. Downstream consumers of rlottie (e.g., Samsung TV/appliance firmware) should verify their vendor's advisory for a packaged fix version. As a compensating control where patching is not immediately possible, restrict the processing of untrusted or externally-sourced Lottie animation files within affected applications; this eliminates the attacker-controlled input path required to trigger the integer truncation. If rlottie is used in a sandboxed rendering process, ensuring that sandbox isolation is properly configured limits the blast radius of a successful crash to the sandbox context rather than the host application.