Stack-based buffer overflow vulnerability in Samsung Open Source rlottie permits overflowing buffers. The flaw exists in the library’s handling of Lottie animation data and can allow an adversary to overwrite adjacent stack memory. If exploited, an attacker could execute arbitrary code or crash the process, thereby compromising the confidentiality, integrity, or availability of the affected system. The weakness corresponds to CWE‑121: Stack-based Buffer Overflow.

Samsung Open Source rlottie, versions prior to the commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035. The flaw was present in all releases that used the vulnerable code path; any deployment that incorporates an earlier version of rlottie is susceptible. Devices and software that embed this library without updating to the patched revision are at risk.

CVSS score of 6.1 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is currently undefined; however, given that rlottie is used to render Lottie animations, the most likely exploitation scenario involves an attacker providing a crafted Lottie file to a vulnerable application. Without an official exploit, the practical exploitation risk remains moderate, but the potential for local code execution warrants timely remediation, especially in environments where trusted input cannot be guaranteed.