VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 4, 2026

CVE-2026-8916

CVE-2026-8916

Description

An out-of-bounds write vulnerability in Samsung's rlottie library can be triggered by overflowing buffers, potentially leading to security issues.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds write vulnerability in Samsung's rlottie library can be triggered by overflowing buffers, potentially leading to security issues.

Vulnerability

An out-of-bounds write vulnerability exists in Samsung Open Source rlottie due to an integer overflow in SW_FT_Outline point/contour counters. This issue affects rlottie versions prior to the commit dcfde72eae1b0464dc0dd760aec00ada6a148635 [1].

Exploitation

An attacker would need to provide specially crafted input to the rlottie library that triggers the integer overflow condition. The exact conditions and steps required for exploitation are not detailed in the available references, but it likely involves manipulating data that is processed by the SW_FT_Outline structure [1].

Impact

Successful exploitation of this out-of-bounds write vulnerability could allow an attacker to corrupt memory, potentially leading to denial-of-service or arbitrary code execution. The scope and privilege level of the impact depend on how and where rlottie is used within an application [1].

Mitigation

The vulnerability is fixed in rlottie by commit dcfde72eae1b0464dc0dd760aec00ada6a148635 [1]. Users should update to a version of rlottie that includes this fix. No specific workaround is mentioned in the available references.

References
  1. fixed integer overflow in SW_FT_Outline point/contour counters by mihashco · Pull Request #589 · Samsung/rlottie

AI Insight generated on Jun 4, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2
  • Samsung Mobile/Rlottiereferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <dcfde72eae1b0464dc0dd760aec00ada6a148635

Patches

1
ffe60942892c

fixed integer overflow in SW_FT_Outline point/contour counters

https://github.com/samsung/rlottieMichal SzczecinskiMay 11, 2026via nvd-ref
commitPR #589
3 files changed · +7 −7
  • src/vector/freetype/v_ft_raster.h+3 −3 modified
    @@ -114,12 +114,12 @@
 /*                                                                       */
 typedef struct  SW_FT_Outline_
 {
-  short       n_contours;      /* number of contours in glyph        */
-  short       n_points;        /* number of points in the glyph      */
+  int         n_contours;      /* number of contours in glyph        */
+  int         n_points;        /* number of points in the glyph      */
 
   SW_FT_Vector*  points;          /* the outline's points               */
   char*       tags;            /* the points flags                   */
-  short*      contours;        /* the contour end points             */
+  int*        contours;        /* the contour end points             */
   char*       contours_flag;   /* the contour open flags             */
 
   int         flags;           /* outline masks                      */
  • src/vector/freetype/v_ft_stroker.cpp+3 −3 modified
    @@ -650,8 +650,8 @@ static void ft_stroke_border_export(SW_FT_StrokeBorder border,
     {
         SW_FT_UInt   count = border->num_points;
         SW_FT_Byte*  tags = border->tags;
-        SW_FT_Short* write = outline->contours + outline->n_contours;
-        SW_FT_Short  idx = (SW_FT_Short)outline->n_points;
+        SW_FT_Int*   write = outline->contours + outline->n_contours;
+        SW_FT_Int  idx = outline->n_points;
 
         for (; count > 0; count--, tags++, idx++) {
             if (*tags & SW_FT_STROKE_TAG_END) {
@@ -661,7 +661,7 @@ static void ft_stroke_border_export(SW_FT_StrokeBorder border,
         }
     }
 
-    outline->n_points = (short)(outline->n_points + border->num_points);
+    outline->n_points = (int)(outline->n_points + border->num_points);
 
     assert(SW_FT_Outline_Check(outline) == 0);
 }
  • src/vector/vraster.cpp+1 −1 modified
    @@ -78,7 +78,7 @@ struct FTOutline {
     SW_FT_Fixed             ftMiterLimit;
     dyn_array<SW_FT_Vector> mPointMemory{100};
     dyn_array<char>         mTagMemory{100};
-    dyn_array<short>        mContourMemory{10};
+    dyn_array<int>          mContourMemory{10};
     dyn_array<char>         mContourFlagMemory{10};
 };

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

1