CVE-2026-49509: CWE-125 Out-of-bounds read in Samsung Opensource rLottie

This vulnerability (CVE-2026-49509) is classified as CWE-125, an out-of-bounds read in Samsung Opensource rLottie. It allows reading beyond the intended buffer boundaries, potentially exposing sensitive information or causing application crashes. The affected code version is identified by the commit hash 25648aef19187b3f87f4d9420b8d761453ad4630. Exploitation requires local access and user interaction, with low attack complexity and no privileges required. The vulnerability impacts confidentiality (partial) and availability (partial), but not integrity. As of the published date, no patch or remediation level has been provided by the vendor.

The vulnerability can lead to partial confidentiality loss through buffer overread and partial availability impact due to potential application crashes. It does not affect data integrity. Exploitation requires local access and user interaction, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to trusted users and avoid interacting with untrusted content that may trigger the vulnerability.