Skip to main content

Samsung rlottie EUVDEUVD-2026-52647

| CVE-2026-18772 MEDIUM
Improper Input Validation (CWE-20)
2026-08-04 samsung.tv_appliance GHSA-9hrp-c4q8-hf75
Information Disclosure Samsung Rlottie
6.5
CVSS 3.1 · Vendor: samsung.tv_appliance
Share

Severity by source

Vendor (samsung.tv_appliance) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

A crafted local file triggers the flaw with no required privileges; user must open the file; impact is availability-only with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung.tv_appliance).

CVSS VectorVendor: samsung.tv_appliance

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Aug 11, 2026 - 05:22 NVD
5.5 (MEDIUM) 6.5 (MEDIUM)
Source Code Evidence Fetched
Aug 04, 2026 - 09:51 vuln.today
Analysis Generated
Aug 04, 2026 - 09:51 vuln.today

DescriptionCVE.org

Improper input validation vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.

AnalysisAI

Resource exhaustion via oversized serialized Lottie animation payloads in Samsung Open Source rlottie allows denial-of-service against any application embedding the library. The library failed to bound precomposition nesting depth, total render-node count, Repeater element copy counts, and did not validate non-finite float values (NaN/Infinity) for polystar and polygon point counts during deserialization and rendering. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious Lottie JSON with unbounded nesting or extreme values
Delivery
Deliver file to target via download, email, or embedded resource
Exploit
User opens file in rlottie-embedding application
Execution
Parser traverses unbounded precomp depth or allocates excessive nodes
Impact
Application crashes or hangs (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability requires that a user or application process a crafted Lottie animation file (.json format) using a vulnerable version of rlottie. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly reflects a local, user-triggered, availability-only impact - this is a crash/hang in the rendering process, not remote code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker creates a Lottie JSON animation file containing precomposition layers nested 33 or more levels deep, or a Repeater element with a copy count of several million, or polystar shapes with NaN point values. The file is delivered to a victim via email attachment, a web download, or as part of a crafted application resource bundle. …
Remediation The upstream fix is available via GitHub PR #596 (https://github.com/Samsung/rlottie/pull/596), which introduces depth limits, node-budget caps, Repeater copy count capping, and non-finite float guards. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rlottie

View all
CVE-2026-19588 MEDIUM
6.5 Aug 12

Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
CVE-2026-19587 MEDIUM
6.5 Aug 12

Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
CVE-2025-53076 CRITICAL
9.8 Jun 30

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
CVE-2025-53075 CRITICAL
9.8 Jun 30

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:
CVE-2025-0634 CRITICAL
9.8 Jun 30

Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
CVE-2025-53074 CRITICAL
9.1 Jun 30

Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
CVE-2026-19518 MEDIUM
6.5 Aug 11

Availability denial-of-service in Samsung's open-source rlottie animation library (all versions per CPE wildcard) allows
CVE-2026-19517 MEDIUM
6.5 Aug 11

Resource exhaustion in Samsung's rlottie library allows denial of service when parsing crafted Lottie animation files. T
CVE-2026-8916 MEDIUM
6.1 Jun 04

Out-of-bounds write in Samsung's rlottie animation rendering library allows a crafted Lottie animation file to trigger i
CVE-2026-47318 MEDIUM
6.1 Jun 04

Stack-based buffer overflow in Samsung Open Source rlottie's FreeType-derived cubic Bezier rasterizer allows a local att
CVE-2026-47306 MEDIUM
6.1 Jun 04

Uncontrolled recursion in Samsung's rlottie library, affecting all versions before commit e2d19e3b, allows a locally-del
CVE-2026-49510 MEDIUM
6.1 Jun 04

Integer overflow in Samsung's rlottie animation library allows a crafted Lottie animation file to trigger memory corrupt

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-52647 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy