What is the CVSS score of EUVD-2026-34234?

EUVD-2026-34234 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

rlottie EUVD-2026-34234

| CVE-2026-10305 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-04 samsung.tv_appliance

GHSA-5x26-gpfr-f429

Information Disclosure Samsung Buffer Overflow

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:25 vuln.today

Analysis Generated

Jun 04, 2026 - 10:25 vuln.today

DescriptionCVE.org

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.

This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

AnalysisAI

Out-of-bounds read in Samsung's rlottie rendering library prior to commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd allows a local attacker to crash the rendering process (high availability impact) or cause low-level integrity corruption by supplying a crafted Lottie animation file. Two distinct code paths are affected: signed integer overflow in FreeType raster bit-shift macros and a missing zero-stopCount guard in gradient color table generation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but the wide embedding of rlottie in Samsung consumer devices (TVs, appliances) represents a meaningful aggregate exposure.

Technical ContextAI

rlottie (CPE: cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie vector animations. The root cause (CWE-125: Out-of-bounds Read) manifests in two separate locations exposed by PR #587. First, in src/vector/freetype/v_ft_raster.cpp, the macros SUBPIXELS, UPSCALE, DOWNSCALE, and SCALED performed left bit-shifts on signed TPos integers without an unsigned cast; signed integer left-shift overflow is undefined behavior in C/C++ and can produce incorrect pointer arithmetic or buffer size calculations, enabling reads beyond allocated raster buffers. The fix wraps operands with (unsigned long) before the shift. Second, in src/vector/vdrawhelper.cpp, the generateGradientColorTable function iterated with the condition i < stopCount - 1; when stopCount is zero and the type is unsigned, this underflows to a very large value, causing the loop to read far past the color stops array. The fix adds an explicit zero-stopCount early-return guard and rewrites the loop condition to i + 1 < stopCount to eliminate the underflow. Both flaws are reachable through attacker-controlled Lottie file content during animation rendering.

RemediationAI

The upstream fix is available via GitHub PR #587 at https://github.com/Samsung/rlottie/pull/587, targeting commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd. The patch modifies src/vector/freetype/v_ft_raster.cpp to add (unsigned long) casts in the SUBPIXELS, UPSCALE, DOWNSCALE, and SCALED macros, and modifies src/vector/vdrawhelper.cpp to add a zero-stopCount early return and fix the loop boundary condition in generateGradientColorTable. This is an upstream fix available via PR/commit; a formally tagged release version has not been independently confirmed at time of analysis - consumers should monitor the Samsung/rlottie repository at https://github.com/Samsung/rlottie for a tagged release and apply the fix commit directly in the interim. As a compensating control, applications can validate Lottie input files prior to rendering - specifically rejecting animations with zero gradient stops or extreme raster coordinate values - though this requires Lottie format parsing logic and does not eliminate all vulnerable code paths. Running the rlottie rendering pipeline in a sandboxed process (e.g., seccomp-restricted subprocess) limits a successful exploit to the rendering context and prevents escalation to the host application; the trade-off is added IPC latency and implementation complexity.