Executive brief
Samsung's rLottie is an open-source animation rendering library used in mobile and web applications. An out-of-bounds read vulnerability in the embedded stb_image component allows an attacker to read beyond allocated memory buffers when processing malformed animation or image files, potentially exposing sensitive data or causing application crashes.
Technical details
This is an out-of-bounds read vulnerability in the stb_image image processing component embedded within Samsung rLottie. The vulnerability stems from improper handling of fractional aspect ratios during image decoding, allowing an attacker to read memory outside the intended buffer boundaries. The issue affects commit 25648aef19187b3f87f4d9420b8d761453ad4630 and requires processing a malformed image or animation file through the rLottie renderer. An attacker can trigger memory disclosure or application denial-of-service. A fix was applied in PR #604 (merged September 1, 2026), aligning the code with stb_image 2.27 fixes for fractional ratio handling.
Affected products
- Samsung rLottie up to commit 25648aef19187b3f87f4d9420b8d761453ad4630
Timeline
- 2026-09-04: disclosed
- 2026-09-01: patched: Fix merged in PR #604