ZDI-26-359: RCE Vulnerability in Samsung rlottie Triggers Urgent…

A critical integer truncation flaw in Samsung’s open-source rlottie library enables remote code execution through malicious vector animations. Although a fix was merged in May 2026, the absence of a CVE identifier leaves many risk management systems blind to the threat.

The ZDI-26-359 advisory, published on June 11, 2026, by the TrendAI Zero Day Initiative, reveals a remote code execution (RCE) vulnerability in Samsung’s open-source graphics library, rlottie. The flaw, reported on April 1, 2026, by researcher Michael DePlante, exploits an integer truncation within the point and contour counters of the library's outline structures. Samsung has released a corrective update. Animated Lottie files are used in messaging apps, social networks, and web platforms that integrate rlottie for vector rendering.

Key Takeaways

ZDI-26-359 enables arbitrary remote code execution on affected Samsung rlottie installations through library interaction.
The vulnerability stems from an integer truncation caused by a failure to validate user-supplied data before memory writes.
The patch, published as GitHub pull request #589 and merged on May 12, 2026, promotes data types from short to int within SW_FT_Outline.
The advisory does not currently include an assigned CVE or CVSS score.

The Mechanism: How a 16-bit Counter Becomes an Execution Vector

The vulnerability resides in rlottie’s management of outline structures. According to the ZDI advisory, "the issue results from the lack of proper validation of user-supplied data, which can result in an integer truncation before writing to memory." The n_contours and n_points counters, defined as 16-bit signed short integers, truncate larger values provided within a malicious Lottie file.

The diff for pull request #589 documents the fix: data types migrate from short to int, pointers move from short* to int*, and corresponding casts in v_ft_stroker.cpp are adjusted. The commit, hash dcfde72eae1b0464dc0dd760aec00ada6a148635, is described as having "fixed integer overflow in SW_FT_Outline point/contour counters." The fix was merged on May 12, 2026.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation." — ZDI Advisory ZDI-26-359

Timeline and Disclosure

The advisory outlines the disclosure timeline. The initial report was filed on April 1, 2026. The coordinated public release occurred on June 11, 2026. Between these dates, on May 12, 2026, the fix was integrated into Samsung’s GitHub repository.

Researcher Michael DePlante, known as @izobashi, is credited with the discovery within the TrendAI Zero Day Initiative.

rlottie Implementation and Risk

Samsung rlottie is an open-source rendering library optimized for mobile devices and integrated into Android applications and cross-platform projects. Lottie files are JSON files describing vector animations used in app onboarding screens, social media reactions, and UI elements.

The ZDI advisory notes that "attack vectors may vary depending on the implementation," which includes scenarios such as chat previews, thumbnail rendering, or background loading of animations. The library is available in the official GitHub repository, and the fix is contained in pull request #589.

Action Plan: Securing the Dependency Tree

Operators maintaining codebases with direct or transitive dependencies on Samsung rlottie must verify the presence of the May 12, 2026, patch. The update is available in the official GitHub repository via pull request #589. The ZDI advisory does not specify exact vulnerable versions; therefore, deployments prior to the May 12, 2026, commit are at risk.

Technical Details of the Fix

The transition from short to int in SW_FT_Outline addresses the vulnerability where counters were sized in a way that allowed for integer truncation. Until the Common Vulnerabilities and Exposures system assigns an identifier, the vulnerability is tracked via ZDI-26-359.

Frequently Asked Questions

Which applications use rlottie and are at risk?

The advisory does not list specific products or applications that incorporate rlottie. While Samsung developed the library, rlottie is open source and available for third-party adoption. The ZDI advisory states that "attack vectors may vary depending on the implementation."

Is there a public exploit or proof-of-concept available?

The ZDI-26-359 advisory does not mention a proof-of-concept or in-the-wild exploits. There are no known active exploitation campaigns at the time of publication.

Why is there no CVE assigned?

The advisory does not list a CVE identifier or a CVSS score. The absence of a CVE does not diminish the technical severity of the documented RCE.

Information has been verified against cited sources and is current as of the publication date.

Sources

Sources and references