CVE-2026-10305
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This...
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
CVE-2026-10305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-34234
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
EUVD-2026-34234- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5x26-gpfr-f429
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This...
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
GHSA-5x26-gpfr-f429- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
CVE-2026-10305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.
This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
CVE-2026-10305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-10305
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
DEBIAN-CVE-2026-10305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-10305
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Record
UBUNTU-CVE-2026-10305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUSN-8559-1 No score
rlottie vulnerabilities
It was discovered that rlottie incorrectly handled certain shift operations. An attacker could possibly use this issue to cause rlottie to read out of bounds, resulting in a denial of service or exposing sensitive information. (CVE-2026-10305)
It was discovered that rlottie did not properly limit recursion when processing certain Lottie animations. An attacker could possibly use this issue to cause rlottie to crash, resulting in a denial of service. (CVE-2026-47306)
It was discovered that rlottie incorrectly handled certain span coordinates. An attacker could possibly use this issue to cause a stack-based buffer overflow, resulting in a denial of service or possibly the execution of arbitrary code. (CVE-2026-47318)
It was discovered that rlottie incorrectly handled certain path data. An attacker could possibly use this issue to cause rlottie to allocate an excessive amount of memory, resulting in a denial of service. (CVE-2026-47319)
It was discovered that rlottie did not properly limit recursion and could access an uninitialized pointer when processing certain Lottie animations. An attacker could possibly use this issue to cause rlottie to crash, resulting in a denial of service. (CVE-2026-47320)
It was discovered that rlottie incorrectly handled certain array lengths in the bundled FreeType raster code. An attacker could possibly use this issue to cause an out-of-bounds write, resulting in a denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-8916)
- Record
USN-8559-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rlottieDebian:12 |
before 0.1+dfsg-4+deb12u2, plus listed versions 0.1+dfsg-40.1+dfsg-4+deb12u1 |
0.1+dfsg-4+deb12u2 |
rlottieDebian:13 |
before 0.1+dfsg-4.2+deb13u2, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.2+deb13u1 |
0.1+dfsg-4.2+deb13u2 |
rlottieDebian:14 |
before 0.1+dfsg-5, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.3 |
0.1+dfsg-5 |
rlottieUbuntu:Pro:20.04:LTS |
before 0~git20200305.a717479+dfsg-1ubuntu0.1~esm3, plus listed versions 0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm2 |
0~git20200305.a717479+dfsg-1ubuntu0.1~esm3 |
rlottieUbuntu:Pro:22.04:LTS |
before 0.1+dfsg-2ubuntu0.2+esm1, plus listed versions 0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.2 |
0.1+dfsg-2ubuntu0.2+esm1 |
rlottieUbuntu:Pro:24.04:LTS |
before 0.1+dfsg-4ubuntu1.1+esm1, plus listed versions 0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.1 |
0.1+dfsg-4ubuntu1.1+esm1 |
rlottieUbuntu:25.10 |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.2ubuntu0.1 |
None known |
rlottieUbuntu:Pro:26.04:LTS |
before 0.1+dfsg-4.3ubuntu0.1~esm1, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.3 |
0.1+dfsg-4.3ubuntu0.1~esm1 |
rlottieUbuntu:Pro:20.04:LTS From an advisory covering 6 CVEs |
before 0~git20200305.a717479+dfsg-1ubuntu0.1~esm3, plus listed versions 0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm2 |
0~git20200305.a717479+dfsg-1ubuntu0.1~esm3 |
rlottieUbuntu:Pro:22.04:LTS From an advisory covering 6 CVEs |
before 0.1+dfsg-2ubuntu0.2+esm1, plus listed versions 0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.2 |
0.1+dfsg-2ubuntu0.2+esm1 |
rlottieUbuntu:Pro:24.04:LTS From an advisory covering 6 CVEs |
before 0.1+dfsg-4ubuntu1.1+esm1, plus listed versions 0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.1 |
0.1+dfsg-4ubuntu1.1+esm1 |
rlottieUbuntu:Pro:26.04:LTS From an advisory covering 6 CVEs |
before 0.1+dfsg-4.3ubuntu0.1~esm1, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.3 |
0.1+dfsg-4.3ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-10305 is a medium vulnerability (CVSS 6.1) in Samsung Open Source Rlottie, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in rlottie 0.1+dfsg-4+deb12u2.