# CVE-2026-10305: Samsung rlottie out-of-bounds read in animation rendering

Source: https://junglewise.ai/threats/cve-2026-10305-samsung-rlottie-out-of-bounds-read-in-animation-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-10305 · Severity: medium · CVSS 6.1 · Published 2026-06-04

Samsung rlottie is an open-source library used for rendering vector-based animations. A vulnerability in this library could allow a specially crafted animation file to cause a crash or unexpected behavior when processed. This could lead to service disruptions or application instability on devices that use this library to display animations, such as smart TVs or mobile apps.

Technologies: [Samsung Rlottie](https://junglewise.ai/threats/technologies/rlottie). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-10305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10305 being exploited in the wild.

**How severe is CVE-2026-10305?** Medium severity, with a CVSS score of 6.1, published 4 June 2026.

**Which products and versions are affected?** Samsung Rlottie before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

**Is there a fix for CVE-2026-10305?** A patch was published on 2026-05-12: Fix merged into master branch via pull request 587 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10305 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-10305?** Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in Samsung's rlottie library due to an overread buffer issue, specifically related to a signed shift error in the code. The vulnerability is triggered when the library processes a malformed animation file. An attacker can exploit this by enticing a user to open a malicious file (User Interaction required), leading to a denial-of-service (application crash) or potentially limited information disclosure. The issue is local in nature (AV:L) and has been addressed in commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

## Affected products

- Samsung rlottie before 223a2a41ba4f462e4abe767bebba49a366c9b9fd

## Timeline

- 2026-05-12: patched: Fix merged into master branch via pull request 587
- 2026-06-04: disclosed: CVE published by Samsung TV & Appliance

## References

- [https://github.com/Samsung/rlottie/pull/587](https://github.com/Samsung/rlottie/pull/587)

## Related threats

- [Samsung rlottie heap-based buffer overflow via environment variables](https://junglewise.ai/threats/cve-2026-108978-heap-based-buffer-overflow-vulnerability-in-samsung-opensource)
- [Samsung rLottie stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-91826-samsung-rlottie-stack-based-buffer-overflow)
- [Samsung rLottie out-of-bounds read in stb_image](https://junglewise.ai/threats/cve-2026-49509-samsung-rlottie-out-of-bounds-read-in-stb-image)
- [Samsung rlottie uncontrolled recursion in shape group parsing](https://junglewise.ai/threats/cve-2026-82797-samsung-rlottie-uncontrolled-recursion-in-shape-group-parsing)
- [Samsung rlottie integer overflow to buffer overflow](https://junglewise.ai/threats/cve-2026-19588-samsung-rlottie-integer-overflow-to-buffer-overflow)