Quick answers
- Is CVE-2026-91826 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91826 being exploited in the wild.
- How severe is CVE-2026-91826?
- Medium severity, with a CVSS score of 4.4, published 15 September 2026.
- Which products and versions are affected?
- Samsung Rlottie prior to commit following 480a2ad0c5d2e45458c545b8213279e9e8b71e39.
- Is there a fix for CVE-2026-91826?
- A patch was published on 2026-09-11: Fix merged in GitHub PR #607 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91826 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-91826?
- Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow exists in rLottie's vector rendering engine (VRLE component) when processing merged scanlines during animation rendering. The vulnerable function bufferToRle() failed to properly bound the span count when converting merged scanlines, allowing an attacker to overflow the output buffer. An attacker can trigger this by providing a crafted vector animation file to an application that uses the affected version of rLottie. The fix, merged in September 2026, adds bounds checking to the span count and skips scanlines that cannot be represented within the buffer capacity.
Affected products
- Samsung rLottie prior to commit following 480a2ad0c5d2e45458c545b8213279e9e8b71e39
Timeline
- 2026-09-15: disclosed
- 2026-09-11: patched: Fix merged in GitHub PR #607