Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when… (CVE-2026-91826)

The vulnerability is a stack-based buffer overflow in Samsung Opensource rLottie, which allows attackers to overflow buffers during the rendering of specially crafted vector animations. This memory corruption issue affects several specific versions of rLottie, including =0.1+dfsg-2, =0.1+dfsg-4.3, and others as enumerated. The CVSS 3.1 base score is 4.4, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation can cause memory corruption leading to potential denial of service or application instability. There is no indication of confidentiality or integrity compromise beyond the stated low integrity impact. The attack requires local access and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and avoid processing untrusted vector animations until a fix is available.