CVE-2026-91826
Received Received - Intake

Stack-based Buffer Overflow in Samsung rLottie

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Samsung TV & Appliance

Description
Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-10-05
AI Q&A
2026-09-15
EPSS Evaluated
2026-10-04
NVD
CVE-2026-91826
EUVD
EUVD-2026-78331

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
samsung r_lottie *
samsung rlottie to 2026-09-11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in Samsung's rLottie library. It occurs when rendering crafted vector animations, causing the bufferToRle() function to overflow buffers and corrupt memory. The issue arises because the function does not properly check the output buffer's capacity before processing scanlines.

Detection Guidance

This vulnerability is specific to the rLottie library and relates to buffer handling in vector animation rendering. Detection requires checking if the affected version of rLottie is installed and analyzing code paths involving the bufferToRle() function for improper buffer capacity checks.

Impact Analysis

An attacker could exploit this to execute arbitrary code or crash applications using the rLottie library. This may lead to denial-of-service conditions or potential unauthorized access if combined with other exploits. Users should update to the patched version to mitigate risks.

Compliance Impact

This vulnerability could potentially lead to memory corruption, which may allow attackers to execute arbitrary code or cause denial-of-service conditions. For GDPR, this could impact data integrity and security obligations under Articles 32 and 34. For HIPAA, it may violate safeguards for protected health information if exploited in systems handling such data.

Mitigation Strategies

Update rLottie to the latest version where the bufferToRle() function fix has been applied to prevent buffer overflow during scanline processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart