rlottie (Product): news timeline & CVEs

ZDI-26-757: (0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

ZDI discloses a user-interaction Telegram rlottie RCE tracked as CVE-2026-111105.

The Zero Day Initiative published ZDI-26-757, a numeric truncation vulnerability in Telegram's rlottie component that could let a remote attacker execute arbitrary code. Exploitation requires the target to visit a malicious page or open a malicious file. ZDI assigned CVSS 7.0 and CVE-2026-111105. The advisory does not say the flaw is being exploited in the wild.

ZDI Published AdvisoriesOct 15, 05:00 UTC · 1d agoVulnerability CVE-2026-1111053· 1 read

ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-91826, a stack-based buffer overflow in Samsung's rlottie animation library enabling remote code execution, rated CVSS 7.8.

ZDI-26-714 describes a stack-based buffer overflow in Samsung's rlottie library that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires interaction with the rlottie library, and attack vectors vary depending on the implementation. ZDI assigned a CVSS score of 7.8 and the issue is tracked as CVE-2026-91826; no exploitation or PoC is mentioned.

ZDI Published AdvisoriesSep 17, 05:00 UTC · 29d agoAdvisory CVE-2026-918261

rlottie

Timeline2 articles

Related CVEsby mentions

Appears with

ZDI-26-757: (0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability