EUVD-2026-34237
GHSA-r436-q6wh-rcxr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.
This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.
AnalysisAI
Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local attacker, via a crafted Lottie animation file, to crash the embedding application or potentially corrupt stack memory. The vulnerable code in gray_render_cubic (src/vector/freetype/v_ft_raster.cpp) subdivides Bezier curves onto a fixed-size bez_stack (capacity 32×3+1 vectors) without a depth guard, so a pathologically complex curve exhausts the buffer. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
rlottie is a Samsung Open Source C++ library that renders Lottie animation files (JSON-based vector graphics) and is embedded in Samsung TV OS and numerous third-party applications. The vulnerable component (src/vector/freetype/v_ft_raster.cpp) is adapted from the FreeType font rasterizer and implements Bezier curve subdivision using a fixed-size stack array bez_stack (capacity: 32×3+1 SW_FT_Vector entries). The gray_render_cubic function recursively subdivides cubic Bezier curves into this array; without bounds validation, a curve requiring more than 31 subdivision levels writes past the end of the stack buffer. The upstream fix (PR #582) inserts the guard if (arc - ras.bez_stack >= 31 * 3) return; before each subdivision step. CWE-121 (Stack-based Buffer Overflow) identifies the root cause class. CPE cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:* confirms all versions prior to the fix commit are affected.
RemediationAI
Update the rlottie dependency to a version incorporating commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035 or later, which adds the bounds check if (arc - ras.bez_stack >= 31 * 3) return; in gray_render_cubic. The fix is available via GitHub PR #582 (https://github.com/Samsung/rlottie/pull/582); a formally tagged release version incorporating this commit is not independently confirmed from the available data - downstream maintainers should cherry-pick the commit into their vendored copy or track the upstream repository for a tagged release. As a compensating control where patching is not immediately possible, applications accepting Lottie files from untrusted sources should run the rlottie renderer in an isolated sandboxed process (e.g., a seccomp-restricted worker or separate container), so that a triggered overflow results in a contained subprocess crash rather than compromising the parent application. Additionally, input validation at the application boundary to reject abnormally large or deeply nested Lottie JSON structures can reduce the attack surface, though this requires application-specific tuning.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-s
Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today