{"id":"CVE-2026-82797","details":"Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.","modified":"2026-10-08T07:15:23.287517228Z","published":"2026-08-31T11:28:08.147Z","database_specific":{"cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82797.json","cna_assigner":"samsung.tv_appliance"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82797.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82797"},{"type":"FIX","url":"https://github.com/Samsung/rlottie/pull/603"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/samsung/rlottie","events":[{"introduced":"0"},{"fixed":"8de0d9e6ca80ffef654965505981727b9fa06a51"}]}],"versions":["v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82797.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51","target":{"function":"LottieParserImpl::parseGroupObject","file":"src/lottie/lottieparser.cpp"},"deprecated":false,"digest":{"length":823,"function_hash":"165477875175686595012492847257698666774"},"id":"CVE-2026-82797-4f5cea73","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["3270914981905464508614041780813690206","10533135866123781050764972674486003156","89485184120685631933638149552712561958","171559662381363971731726697892314817256","145689586090703069167208076344910832276","143717762820069605831522460727606015817","340070422019916217703340100510662775988","122563825636038882594005758527456705645","82754120089104293328240141528079461456","86079765523972876366376107265985428818","256381032833248048927638519471410184419","324400458097072797366463945618656997019","31024569588367764023374328533780132988","261533773973370965625946251949851511563","41546319736947617630882011835476410486"],"threshold":0.9},"id":"CVE-2026-82797-5195903d","signature_type":"Line","signature_version":"v1","source":"https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51","target":{"file":"src/lottie/lottieparser.cpp"}},{"signature_version":"v1","source":"https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51","target":{"file":"src/lottie/lottiemodel.cpp"},"deprecated":false,"digest":{"line_hashes":["248751173952086816211398028741007879528","4849998269134322798580524679736147800","88432152888640206842021231350340237609","335136385223389897421599186800671270916"],"threshold":0.9},"id":"CVE-2026-82797-5f6d80a2","signature_type":"Line"},{"digest":{"line_hashes":["206684468719099779356549093820309945665","77319607010456995319413684786491136754","4471865659794436313212812027572248576"],"threshold":0.9},"id":"CVE-2026-82797-7209fd30","signature_type":"Line","signature_version":"v1","source":"https://github.com/samsung/rlottie/commit/8de0d9e6ca80ffef654965505981727b9fa06a51","target":{"file":"src/lottie/lottiemodel.h"},"deprecated":false}],"vanir_signatures_modified":"2026-10-08T07:15:23Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}