Executive brief
Samsung rlottie is an open-source library used for rendering vector animations, commonly found in mobile apps and smart appliances. A vulnerability in how the library handles animation coordinates could allow a malicious file to cause a system crash or potentially execute unauthorized code. This could impact the stability of the device or the security of user data if a user is tricked into opening a specially crafted animation file.
Technical details
An integer overflow vulnerability (CWE-190) exists in Samsung's rlottie library due to improper coordinate clamping. The root cause is a narrowing conversion where a 32-bit integer coordinate is stored into a 16-bit short field (`SW_FT_Span.y`) without adequate bounds checking. Because the library inherited clamping logic from FreeType that assumed a 32-bit destination, the existing `INT_MAX` check failed to prevent truncation when the value was assigned to the 16-bit short. An attacker can exploit this by providing a crafted animation file that triggers a heap buffer overflow. Exploitation requires local access and user interaction (opening a file) and is hindered by high complexity. A fix was merged in July 2026 via pull request #595.
Affected products
- Samsung Open Source rlottie Prior to commit f487eff
Timeline
- 2026-07-01: disclosed: Pull request submitted to fix the overflow issue
- 2026-07-03: patched: Fix merged into master branch via commit f487eff
- 2026-07-13: advisory: CVE-2026-15551 published