EUVD-2026-34238
GHSA-598h-r4p3-q3wf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers.
This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.
AnalysisAI
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger integer truncation in the embedded FreeType rasterizer, causing memory corruption. All rlottie versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635 are affected, spanning any downstream product or platform embedding this library (including Samsung TV and appliance firmware). Exploitation requires local access and user interaction to render a malicious animation, with primary impact being high availability loss (crash/DoS) and limited integrity impact; no public exploit identified at time of analysis and no active exploitation confirmed.
Technical ContextAI
rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is a Samsung Open Source C++ library for rendering Lottie JSON-based vector animations, embedded in Samsung TV and appliance firmware among other products. The vulnerability (CWE-787: Out-of-bounds Write) resides in the FreeType rasterizer component across three files: v_ft_raster.h, v_ft_stroker.cpp, and vraster.cpp. The root cause is integer width mismatch: fields n_contours and n_points, and the contours pointer array, were typed as short (SW_FT_Short, 16-bit signed, max 32,767). When processing complex Lottie animations whose contour or point counts exceed this limit, the values are silently truncated, causing incorrect pointer arithmetic in ft_stroke_border_export() and out-of-bounds writes into the outline buffer. The PR diff confirms the fix is a straightforward type widening: short/SW_FT_Short → int/SW_FT_Int across all relevant fields and casts, eliminating the truncation path.
RemediationAI
Upgrade to the rlottie build containing commit dcfde72eae1b0464dc0dd760aec00ada6a148635, available via the upstream fix at https://github.com/Samsung/rlottie/pull/589. Note that no independently confirmed tagged release version is associated with this fix - the patch exists as a merged PR/commit, and a specific release version has not been confirmed in the available data. Downstream consumers of rlottie (e.g., Samsung TV/appliance firmware) should verify their vendor's advisory for a packaged fix version. As a compensating control where patching is not immediately possible, restrict the processing of untrusted or externally-sourced Lottie animation files within affected applications; this eliminates the attacker-controlled input path required to trigger the integer truncation. If rlottie is used in a sandboxed rendering process, ensuring that sandbox isolation is properly configured limits the blast radius of a successful crash to the sandbox context rather than the host application.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today