ZDI-CAN-30288: ZDI-26-359: Samsung rlottie Numeric Truncation Remote Code Execution Vulnerability

Published Jun 11, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-8916.

Affected Software

1 affected component

Samsung rLottie

Event History

Jun 11, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-30288?

The vulnerability ZDI-CAN-30288 has a CVSS rating of 7.8, indicating a high severity.

How do I fix ZDI-CAN-30288?

To mitigate the ZDI-CAN-30288 vulnerability, ensure that you are using the latest version of the Samsung rlottie library, where the issue has been addressed.

What type of attacks can be performed using ZDI-CAN-30288?

ZDI-CAN-30288 allows remote attackers to execute arbitrary code on affected installations through interaction with the rlottie library.

Is user interaction required to exploit ZDI-CAN-30288?

Yes, interaction with the rlottie library is required to exploit the vulnerability ZDI-CAN-30288.

Which software is affected by ZDI-CAN-30288?

The vulnerability ZDI-CAN-30288 affects installations of the Samsung rlottie library.