CVE-2026-49509 - Vulnerability Details - OpenCVE

Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Samsung Open Source	Escargot

No data.

No data.

References

Link	Providers
https://github.com/Samsung/rlottie/pull/604

History

Sun, 06 Sep 2026 23:15:00 +0000

Type	Values Removed	Values Added
Title	Escargot Out‑of‑Bounds Read Vulnerability

Sun, 06 Sep 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers. This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.	Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.

Sat, 05 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 04 Sep 2026 00:45:00 +0000

Type	Values Removed	Values Added
Title		Escargot Out‑of‑Bounds Read Vulnerability
First Time appeared		Samsung Open Source Samsung Open Source escargot
Vendors & Products		Samsung Open Source Samsung Open Source escargot

Thu, 03 Sep 2026 23:30:00 +0000

Type	Values Removed	Values Added
Description		Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers. This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.
Weaknesses		CWE-125
References		https://github.com/Samsung/rlottie/pull/604
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: samsung.tv_appliance

Published: 2026-09-03T23:03:36.723Z

Updated: 2026-09-06T21:39:30.597Z

Reserved: 2026-06-01T01:41:22.546Z

Link: CVE-2026-49509

Vulnrichment

Updated: 2026-09-04T19:48:33.239Z

NVD

Status : Deferred

Published: 2026-09-04T00:17:12.820

Modified: 2026-09-08T19:09:50.263

Link: CVE-2026-49509

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49509", "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe", "state": "PUBLISHED", "assignerShortName": "samsung.tv_appliance", "dateReserved": "2026-06-01T01:41:22.546Z", "datePublished": "2026-09-03T23:03:36.723Z", "dateUpdated": "2026-09-06T21:39:30.597Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe", "shortName": "samsung.tv_appliance", "dateUpdated": "2026-09-06T21:39:30.597Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds read", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"vendor": "Samsung Opensource", "product": "rLottie", "versions": [{"status": "affected", "version": "25648aef19187b3f87f4d9420b8d761453ad4630"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers.\n\nThis issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers.<p>This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.</p>"}]}], "references": [{"url": "https://github.com/Samsung/rlottie/pull/604"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"}}], "credits": [{"lang": "en", "value": "Alifia Rahmah (VyPr AI)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-04T19:48:28.220292Z", "id": "CVE-2026-49509", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T19:48:37.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49509", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-04T19:48:28.220292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T19:48:33.239Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alifia Rahmah (VyPr AI)"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Samsung Opensource", "product": "rLottie", "versions": [{"status": "affected", "version": "25648aef19187b3f87f4d9420b8d761453ad4630"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/Samsung/rlottie/pull/604"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers.\n\nThis issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.", "supportingMedia": [{"type": "text/html", "value": "Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers.<p>This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds read"}]}], "providerMetadata": {"orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe", "shortName": "samsung.tv_appliance", "dateUpdated": "2026-09-06T21:39:30.597Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49509", "state": "PUBLISHED", "dateUpdated": "2026-09-06T21:39:30.597Z", "dateReserved": "2026-06-01T01:41:22.546Z", "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe", "datePublished": "2026-09-03T23:03:36.723Z", "assignerShortName": "samsung.tv_appliance"}, "dataVersion": "5.2"}