Samsung Open Source rlottie contains an out‑of‑bounds write that allows an attacker to overflow internal buffers. This flaw can corrupt memory used by the library, potentially leading to application crashes or providing a path to arbitrary code execution. The vulnerability is a classic example of CWE‑787 and is present in all versions prior to the last fixed revision.

Affects the Samsung Open Source rlottie rendering library. All releases before commit dcfde72eae1b0464dc0dd760aec00ada6a148635 are vulnerable. Users of older builds that process Lottie animation files should be aware of this risk.

The CVSS score of 6.1 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation evidence is not currently known. The attack vector is inferred to be the processing of malicious Lottie files by any application that links to rlottie, which could be local or remote depending on the context. Because the flaw causes a buffer overflow, a successful exploitation could lead to denial of service or, in the presence of additional control‑flow hijacking techniques, arbitrary code execution.