CVE-2026-10305
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Out-of-bounds read vulnerability in Samsung's rlottie library allows buffer overread. The issue affects versions before commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
Risk Assessment
An attacker could exploit this to read memory beyond the buffer, potentially leaking sensitive information.
Recommendation
Update rlottie to a version containing commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd or later.
Other vulnerabilities in rlottie
See all- CVE-2026-19588Medium
In Samsung Open Source rlottie, an integer overflow vulnerability leads to buffer overflow, potentially allowing arbitrary code execution.
- CVE-2026-19587Medium
In Samsung Open Source rlottie, an uncontrolled resource consumption vulnerability leads to excessive memory allocation.
- CVE-2026-19518Medium
A vulnerability in Samsung Open Source rlottie involves improper validation of specified quantity in input, allowing input data manipulation.
- CVE-2026-19517Medium
A vulnerability in Samsung Open Source rlottie involves improper validation of specified quantity in input and allocation of resources without limits or throttling, allowing excessive allocation.
- CVE-2026-18772Medium
The Samsung Open Source rlottie library has a vulnerability in improperly controlled sequential memory allocation, allowing Exponential Data Expansion.
- CVE-2026-15551Medium
An integer overflow or wraparound vulnerability in Samsung Open Source rlottie leads to buffer overflows. This issue could allow an attacker to execute code or cause a crash.
- CVE-2026-8916Medium
Out-of-bounds write vulnerability in Samsung's rlottie library allows buffer overflows. The issue affects versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635.
- CVE-2026-49510Medium
Integer overflow vulnerability in Samsung's rlottie library allows integer attacks. The issue affects versions before commit 21292665023e5074b38254432716866d00f1985f.
- CVE-2026-47320Medium
Access of uninitialized pointer and uncontrolled recursion vulnerability in Samsung's rlottie library allows pointer manipulation and oversized serialized data payloads. The issue affects versions before commit eae37633fda13ac05b25c6c95aacea4bc33c80a3.
- CVE-2026-47319Medium
Memory allocation with excessive size value vulnerability in Samsung's rlottie library allows excessive allocation. The issue affects versions before commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.
Original NVD description (English source)
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.