CVE-2025-0634
BaseFortify
Publication date: 2025-06-30
Last updated on: 2025-07-08
Assigner: Samsung TV & Appliance
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samsung | rlottie | 0.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Use After Free issue in the Samsung Open Source rLottie library (version 0.2). It allows remote code inclusion, meaning an attacker could exploit the way rLottie handles Lottie animation files to execute arbitrary code remotely. The problem arises from improper memory management, where the program accesses memory after it has been freed, potentially leading to security breaches.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to remotely execute code on a system using the vulnerable rLottie library. This could lead to unauthorized control over the affected system, data compromise, or further exploitation. Since the vulnerability involves remote code inclusion, it poses a significant security risk, especially if the system processes untrusted Lottie animation files.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Samsung rlottie component to the latest version where multiple validation checks have been added to prevent exploitation. These include type checking before casting, bounds checking to prevent out-of-bounds memory access, verifying non-empty frames vectors, and rejecting outlier values. Applying these patches ensures safer parsing and handling of Lottie animation files, reducing the risk of remote code inclusion. [1]