Quick answers
- Is CVE-2026-82797 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82797 being exploited in the wild.
- How severe is CVE-2026-82797?
- Medium severity, with a CVSS score of 5.5, published 31 August 2026.
- Which products and versions are affected?
- Samsung Rlottie before 8de0d9e6ca80ffef654965505981727b9fa06a51.
- Is there a fix for CVE-2026-82797?
- A patch was published on 2026-08-19: Fix merged in PR #603 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82797 attacked?
- It is attacked with local access or over the network, in a software library.
- Am I affected by CVE-2026-82797?
- Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an uncontrolled recursion flaw in the shape group parsing logic of rlottie. The parseGroupObject function recursively processes nested "gr" (group) objects without enforcing a depth limit, allowing an attacker to craft a serialized animation payload with arbitrarily deep nesting. An application processing such a file will exhaust the call stack and crash. The fix applies a maximum nesting depth limit of 32 to the recursive parsing, halting traversal of deeper content. Network or local delivery of a malicious animation file is required; no authentication is needed.
Affected products
- Samsung rlottie before 8de0d9e6ca80ffef654965505981727b9fa06a51
Timeline
- 2026-08-31: disclosed
- 2026-08-19: patched: Fix merged in PR #603