Executive brief
Samsung's rLottie is an open-source animation rendering library used to display vector animations in applications. A stack-based buffer overflow vulnerability allows attackers to crash applications or corrupt memory by providing specially crafted animation files, potentially leading to code execution or service disruption.
Technical details
A stack-based buffer overflow exists in rLottie's vector rendering engine (VRLE component) when processing merged scanlines during animation rendering. The vulnerable function bufferToRle() failed to properly bound the span count when converting merged scanlines, allowing an attacker to overflow the output buffer. An attacker can trigger this by providing a crafted vector animation file to an application that uses the affected version of rLottie. The fix, merged in September 2026, adds bounds checking to the span count and skips scanlines that cannot be represented within the buffer capacity.
Affected products
- Samsung rLottie prior to commit following 480a2ad0c5d2e45458c545b8213279e9e8b71e39
Timeline
- 2026-09-15: disclosed
- 2026-09-11: patched: Fix merged in GitHub PR #607