PT-2026-46179 · Samsung · Rlottie

CVE-2026-8916 · Published 2026-06-04 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions rlottie versions prior to dcfde72eae1b0464dc0dd760aec00ada6a148635

Description An out-of-bounds write issue in Samsung Open Source rlottie allows for buffer overflows. An out-of-bounds write occurs when a program writes data past the end or before the beginning of the intended buffer, which can lead to memory corruption.

Recommendations Update rlottie to version dcfde72eae1b0464dc0dd760aec00ada6a148635 or later.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-8916

USN-8559-1

ZDI-26-359

Affected Products

Rlottie

References · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8916 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-8916 · Security Note
• https://ubuntu.com/security/CVE-2026-47320 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8916 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-359 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8916 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8559-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47319 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-10305 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8559-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47306 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-8916 · Vendor Advisory
• https://github.com/Samsung/rlottie/pull/589 · Note