Executive brief
Samsung's rlottie is an open-source library used to render vector animations, commonly found in mobile apps and smart appliances. A vulnerability in how it handles animation files could allow a specially crafted file to crash the application or cause it to behave unexpectedly. This could lead to service interruptions or application instability if a user opens a malicious animation.
Technical details
An integer overflow vulnerability exists in the Gradient::populate() function within src/lottie/lottiemodel.cpp of the Samsung rlottie library. The root cause is insufficient validation of the 'colorPoints' value (the 'g.p' field) from untrusted JSON input; specifically, values greater than or equal to 0x40000000 cause an overflow when multiplied by 4. This overflow results in a zero-value calculation that bypasses subsequent bounds checks, leading to a heap buffer over-read during gradient rendering. An attacker can exploit this by providing a malicious Lottie animation file, requiring local user interaction to open the file. The primary impact is a denial-of-service (crash), though it may also lead to minor integrity issues.
Affected products
- Samsung rlottie before 21292665023e5074b38254432716866d00f1985f
Timeline
- 2026-06-01: other: Fix proposed via GitHub Pull Request
- 2026-06-04: advisory: NVD publication date