CVE-2026-49509: CWE-125 Out-of-bounds read in Samsung Opensource rLottie

This vulnerability (CVE-2026-49509) is classified as CWE-125, an out-of-bounds read in Samsung Opensource Escargot's rLottie component. The issue allows the software to read memory beyond the intended buffer limits, which can cause overread of buffers. The affected version is specifically identified by the commit hash 25648aef19187b3f87f4d9420b8d761453ad4630. The CVSS vector indicates the attack requires local access (AV:L), low complexity (AC:L), no privileges (PR:N), user interaction (UI:R), and impacts confidentiality and availability at a low level. No patch or remediation information is currently available.

The vulnerability can lead to unauthorized reading of memory beyond buffer boundaries, which may result in limited information disclosure and potential application crashes or instability. The CVSS score of 4.4 reflects a moderate impact primarily on confidentiality and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Samsung Opensource advisories for updates. Until a fix is available, avoid exposing vulnerable versions to untrusted users and limit local access where possible.