Samsung rlottie: RCE Bug in Lottie Animations, Patch Available Since July 3

On July 15, 2026, Trend Micro's Zero Day Initiative publicly disclosed vulnerability ZDI-26-422 affecting Samsung rlottie, an open-source library for rendering Lottie animations. The flaw, tracked as CVE-2026-15551 with a CVSS 5.5 score per the official CVE Record, allows remote code execution in the context of the current process via a specially crafted animated Lottie file. Samsung had already fixed the bug on July 3, 2026; coordinated disclosure occurred on July 15, 2026.

How the Flaw Works: Numeric Truncation in gray_hline()

The vulnerability stems from an incomplete adaptation of legacy code. Samsung's rlottie library inherits the ftgrays.c module from the FreeType project, responsible for anti-aliased rasterization. In the original FreeType code, the FT_Span structure lacks a y field; the scanline coordinate is managed separately as a 32-bit integer. Samsung introduced a y field of type 16-bit short into the SW_FT_Span structure but did not resize the validation clamp.

The inherited clamp uses INT_MAX as the upper bound. On a system where int is 32-bit, this value far exceeds the capacity of a 16-bit short (32,767). When gray_hline() processes malformed Y coordinates in a Lottie file with native canvas dimensions, the INT_MAX check proves ineffective: the value passes validation but is then truncated during assignment to the short y field. This narrowing produces negative or wrapped coordinates that cause an out-of-bounds heap buffer write during rendering.

The official patch, described in GitHub pull request #595, modifies the clamp by replacing INT_MAX with SHRT_MAX: "SW_FT_Span.y is a 16-bit short, so limit our coordinates appropriately." The fix was merged into the Samsung repository on July 3, 2026, via commit f487eff.

"rlottie added a short y to the span struct without adapting the clamp, so the INT_MAX bound never prevented the (short) narrowing at the store site" — GitHub PR #595, mmaciola

Attack Surface: Who Integrates rlottie

Samsung rlottie is a C++ rendering library for Lottie animations, a JSON-based format originating from After Effects that has become the de facto standard for micro-animations in user interfaces. Its open-source nature and permissive license have driven adoption across mobile, desktop, and web ecosystems. The dossier does not list specific affected versions or products beyond the library itself, nor does it document vulnerable third-party implementations.

The attack vector requires the user to open or view a specially crafted animated Lottie file. The official CVSS specifies AV:L (local attack vector) and UI:R (user interaction required), with AC:H (high attack complexity). The official ZDI citation notes that "interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation." The source does not specify which implementations are vulnerable or provide details on specific vectors.

Score Discrepancy: 5.5 vs. 7.8

The dossier reports a CVSS scoring discrepancy warranting clarification. The official cve.org CVE Record for CVE-2026-15551 assigns a score of 5.5 with MEDIUM severity, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H. In the table of published ZDI advisories, ZDI-CAN-30236 — the same identifier linked to ZDI-26-422 — reports a CVSS of 7.8. The dossier does not clarify whether the 7.8 refers to a different metric, a preliminary ZDI assessment, or a library version with modified environmental parameters. The 5.5 from the official CVE Record serves as the normative reference for severity classification.

Disclosure Timeline and Coordination

The timeline documents responsible disclosure. Researcher Michael DePlante (@izobashi) reported the vulnerability to Samsung on June 26, 2026. The vendor produced and merged the fix on July 3, 2026 — 7 days after the report — and ZDI published the coordinated advisory on July 15, 2026. The 12-day gap between patch and disclosure represents the standard window for coordinated distribution.

The total 19 days between initial report and public disclosure falls within the parameters of effective coordinated disclosure. The speed of Samsung's fix — 7 days — indicates high priority assigned to the flaw, despite the official CVSS score of 5.5.

What to Do Now

Developers using rlottie as a direct dependency must verify the presence of corrective commits f487eff and bf689b72 in their source tree. If the library is included as a subproject or transitive dependency, updating to the revision containing these commits resolves the vulnerability. The official CVE Record indicates the unaffected version starting from commit bf689b72b8482c5ea674235854bd11b6d1b42588.

For teams unable to update immediately, mitigation involves preliminary validation of native canvas dimensions in incoming Lottie files. The CVE Record specifies the trigger relates to "native canvas size" in the parsing context; a consistency check on Y coordinates before passing to gray_hline() can block the vulnerable path. This validation must be implemented at the wrapper or ingestion pipeline level, before the file reaches the rlottie renderer.

Information has been verified against cited sources: ZDI-26-422 advisory, CVE-2026-15551 CVE Record, and GitHub pull request #595 of the Samsung/rlottie repository.

Information verified against cited sources and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-422/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-15551
• https://github.com/Samsung/rlottie/pull/595
• http://www.zerodayinitiative.com/advisories/upcoming/