An integer truncation in the gray_hline() function of Samsung Open Source rlottie triggers a heap‑based buffer overflow when a crafted Lottie animation is rendered at its native canvas size. The overflow corrupts heap memory, potentially causing process crashes or other unintended behavior. The CVE description does not state any capability for code execution, privilege escalation, or other specific impact beyond the buffer corruption.

The vulnerability affects Samsung Open Source rlottie, a lightweight animation engine used in Samsung and third‑party applications that render Lottie JSON files. No specific version range is listed in the CVE data; the referenced pull request indicates that the patch was introduced in the upstream source. All builds compiled without the bounds fix for gray_hline() may be vulnerable.

With a CVSS score of 5.5 this flaw is considered medium severity. The EPSS score of less than 1% indicates very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an application that loads and renders a malicious Lottie file at canvas scale; exploitation would require no authentication or elevated privileges. No public exploit has been reported.