ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-91826, a stack-based buffer overflow in Samsung's rlottie animation library enabling remote code execution, rated CVSS 7.8.
ZDI-26-714 describes a stack-based buffer overflow in Samsung's rlottie library that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires interaction with the rlottie library, and attack vectors vary depending on the implementation. ZDI assigned a CVSS score of 7.8 and the issue is tracked as CVE-2026-91826; no exploitation or PoC is mentioned.
- Stack-based buffer overflow allows remote code execution on affected installations
- Exploitation requires interaction with rlottie; attack vectors vary by implementation
- CVSS 7.8 rating assigned by the Zero Day Initiative
- No mention of in-the-wild exploitation or public PoC
- CVEs
- CVE-2026-91826
- Vendors
- SamsungZero Day Initiative
- Products
- rlottie
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91826 | Stack-Based Buffer Overflow in Samsung rLottie Animation Renderer | 4.4 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.