CVE-2026-49510
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer...
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
CVE-2026-49510- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-34235
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
EUVD-2026-34235- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fxgp-4mch-4c5h
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer...
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
GHSA-fxgp-4mch-4c5h- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks.
This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
CVE-2026-49510- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-49510
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
DEBIAN-CVE-2026-49510- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-49510
Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.
- Record
UBUNTU-CVE-2026-49510- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rlottieDebian:12 |
before 0.1+dfsg-1 | 0.1+dfsg-1 |
rlottieDebian:13 |
before 0.1+dfsg-1 | 0.1+dfsg-1 |
rlottieDebian:14 |
before 0.1+dfsg-1 | 0.1+dfsg-1 |
rlottieUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm20~git20200305.a717479+dfsg-1ubuntu0.1~esm3 |
None known |
rlottieUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.20.1+dfsg-2ubuntu0.2+esm1 |
None known |
rlottieUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.10.1+dfsg-4ubuntu1.1+esm1 |
None known |
rlottieUbuntu:25.10 |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.2ubuntu0.1 |
None known |
rlottieUbuntu:26.10 |
All versions, plus listed versions 0.1+dfsg-4.30.1+dfsg-5 |
None known |
rlottieUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.30.1+dfsg-4.3ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49510 is a medium vulnerability (CVSS 6.1) in Samsung Open Source Rlottie, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 1st percentile. Fixed in rlottie 0.1+dfsg-1.