Samsung rlottie EUVD-2026-52647

The vulnerability requires that a user or application process a crafted Lottie animation file (.json format) using a vulnerable version of rlottie. User interaction is required (UI:R per CVSS) - the file must be actively opened or rendered by an application. The attacker does not need authentication or system privileges to craft the malicious file (PR:N), but the file must reach the target system and be passed to an rlottie rendering context. Exploitation is limited to denial-of-service (application crash or hang); the CVSS vector C:N/I:N confirms no confidentiality or integrity impact, despite the 'Information Disclosure' tag in the source report. Exploitation is further constrained by the local attack vector (AV:L): the malicious file must reside on or be accessible to the target system. Applications that do not process externally sourced Lottie files, or that sandbox rendering, are not meaningfully exposed.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly reflects a local, user-triggered, availability-only impact - this is a crash/hang in the rendering process, not remote code execution. Attack complexity is low once a malicious file is delivered, but the local vector and required user interaction significantly reduce opportunistic exploitation risk. No EPSS data was provided and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. Notably, the source tags include 'Information Disclosure' which directly conflicts with the CVSS C:N metric; no code path in the provided PR diff suggests memory disclosure - this discrepancy should be verified with the Samsung reporter before treating it as a confidentiality risk. The primary real-world risk is application crash for any product embedding rlottie (including Samsung Smart TV applications and Tizen-based devices) when processing attacker-controlled animation content. Risk is proportional to whether the embedding application exposes Lottie rendering to untrusted file input.

An attacker creates a Lottie JSON animation file containing precomposition layers nested 33 or more levels deep, or a Repeater element with a copy count of several million, or polystar shapes with NaN point values. The file is delivered to a victim via email attachment, a web download, or as part of a crafted application resource bundle. When the victim opens the file in a Samsung Smart TV app or any rlottie-embedding application, the renderer recurses without bound or allocates memory without limit, crashing or freezing the application. No exploit code has been publicly released, but the PR diff fully documents the vulnerable code paths, making independent reproduction straightforward.