CVE-2026-91826

CVE-2026-91826 is a stack-based buffer overflow (CWE-121) in Samsung's open-source rLottie library, which renders Lottie vector animations. It is triggered when the library processes a specially crafted vector animation file, overflowing a stack buffer and corrupting memory; Samsung's CVSS scoring (AV:L/UI:R) indicates a local vector requiring user interaction, while ZDI's advisory headline characterizes the outcome as potentially remote code execution. An attacker who can get a victim to render the malicious animation could achieve memory corruption with at least integrity and availability impact, and per ZDI possibly code execution. Anyone embedding or running rLottie at the affected commit is affected, including downstream applications that bundle the library for animation rendering. No public proof-of-concept or confirmed exploitation is known, and the issue is not in CISA KEV.

What to do: Update rLottie to a build newer than commit 480a2ad0c5d2e45458c545b8213279e9e8b71e39 (latest upstream patched release) and rebuild any application that statically links or bundles the library. Until patched, avoid opening or rendering Lottie animation files (e.g., animated stickers) from untrusted sources, and check vendor advisories for apps embedding rLottie.