CVE-2026-91826
Received Received - Intake

Stack-based Buffer Overflow in Samsung rLottie

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Samsung TV & Appliance

Description
Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91826
EUVD
EUVD-2026-78331

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
samsung r_lottie *
samsung rlottie to 2026-09-11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in Samsung's rLottie library. It occurs when rendering crafted vector animations, causing the bufferToRle() function to overflow buffers and corrupt memory. The issue arises because the function does not properly check the output buffer's capacity before processing scanlines.

Impact Analysis

An attacker could exploit this to execute arbitrary code or crash applications using the rLottie library. This may lead to denial-of-service conditions or potential unauthorized access if combined with other exploits. Users should update to the patched version to mitigate risks.

Mitigation Strategies

Update rLottie to the latest version where the bufferToRle() function fix has been applied to prevent buffer overflow during scanline processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart