CVE-2026-82797

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82797

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82797.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82797

Downstream

Published

2026-08-31T11:28:08Z

Modified

2026-10-28T11:01:34Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.

This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.

Database specific

{
    "cna_assigner":  "samsung.tv_appliance",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82797.json"
}

References

Affected packages

Git / github.com/samsung/rlottie

Affected ranges

Type

GIT

Repo

https://github.com/samsung/rlottie

Events

Introduced

Fixed

8de0d9e6ca80ffef654965505981727b9fa06a51

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "8de0d9e6ca80ffef654965505981727b9fa06a51"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*

v0.1

v0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82797.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "165477875175686595012492847257698666774",
            "length":  823
        },
        "id":  "CVE-2026-82797-4f5cea73",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51",
        "target":  {
            "file":  "src/lottie/lottieparser.cpp",
            "function":  "LottieParserImpl::parseGroupObject"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "3270914981905464508614041780813690206",
                "10533135866123781050764972674486003156",
                "89485184120685631933638149552712561958",
                "171559662381363971731726697892314817256",
                "145689586090703069167208076344910832276",
                "143717762820069605831522460727606015817",
                "340070422019916217703340100510662775988",
                "122563825636038882594005758527456705645",
                "82754120089104293328240141528079461456",
                "86079765523972876366376107265985428818",
                "256381032833248048927638519471410184419",
                "324400458097072797366463945618656997019",
                "31024569588367764023374328533780132988",
                "261533773973370965625946251949851511563",
                "41546319736947617630882011835476410486"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-82797-5195903d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51",
        "target":  {
            "file":  "src/lottie/lottieparser.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "248751173952086816211398028741007879528",
                "4849998269134322798580524679736147800",
                "88432152888640206842021231350340237609",
                "335136385223389897421599186800671270916"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-82797-5f6d80a2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51",
        "target":  {
            "file":  "src/lottie/lottiemodel.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "206684468719099779356549093820309945665",
                "77319607010456995319413684786491136754",
                "4471865659794436313212812027572248576"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-82797-7209fd30",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51",
        "target":  {
            "file":  "src/lottie/lottiemodel.h"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:01:34Z"