Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-15551 EUVD-2026-43257GHSA-h37q-3gh3-x72p

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Published Jul 13, 2026 · Updated Jul 13, 2026 · Assigned by samsung.tv_appliance

Description

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

This issue affects .

Affected products

VendorProductAffectedFixed
Samsung Open Source rlottie — bf689b72b8482c5ea674235854bd11b6d1b42588

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rlottie No fix yet —
Debian 13 rlottie No fix yet —
Debian 12 rlottie No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rlottie No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS rlottie No fix yet —
Ubuntu Pro 24.04 LTS rlottie No fix yet —
Ubuntu Pro 22.04 LTS rlottie No fix yet —
Ubuntu Pro 20.04 LTS rlottie No fix yet —

References