Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-110934 (GCVE-0-2026-110934)

Vulnerability from nvd – Published: 2026-10-15 06:51 – Updated: 2026-10-15 14:54

Summary

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:54 UTC

CWE

CWE-129 - Improper validation of array index

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/Vyond/commit/be6e297b0…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Vyond	Affected: 0 , < be6e297b0c4836e20d73b2f8a40a561ea496ebaa (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:54:13.798579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:54:19.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vyond",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "be6e297b0c4836e20d73b2f8a40a561ea496ebaa",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\u003cp\u003eThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.\u003c/p\u003e"
            }
          ],
          "value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\n\nThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper validation of array index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:51:21.891Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/Vyond/commit/be6e297b0c4836e20d73b2f8a40a561ea496ebaa"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110934",
    "datePublished": "2026-10-15T06:51:21.891Z",
    "dateReserved": "2026-10-15T06:08:05.108Z",
    "dateUpdated": "2026-10-15T14:54:19.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110933 (GCVE-0-2026-110933)

Vulnerability from nvd – Published: 2026-10-15 06:51 – Updated: 2026-10-15 14:54

Summary

Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:54 UTC

CWE

CWE-248 - Uncaught exception

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/Vyond/commit/fb10a5c8b…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Vyond	Affected: 0 , < fb10a5c8b833df7f152d4a563a61d6090a1790d7 (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:54:39.218153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:54:46.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vyond",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "fb10a5c8b833df7f152d4a563a61d6090a1790d7",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\u003cp\u003eThis issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.\u003c/p\u003e"
            }
          ],
          "value": "Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\n\nThis issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:51:04.308Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/Vyond/commit/fb10a5c8b833df7f152d4a563a61d6090a1790d7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110933",
    "datePublished": "2026-10-15T06:51:04.308Z",
    "dateReserved": "2026-10-15T06:08:01.161Z",
    "dateUpdated": "2026-10-15T14:54:46.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110392 (GCVE-0-2026-110392)

Vulnerability from nvd – Published: 2026-10-14 01:35 – Updated: 2026-10-14 18:02

Title

Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

Summary

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:02 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/qaboard/commit/05789e6…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	QA-Board	Unaffected: 0.8.x (first public release) through 1.0.1

Credits

p4p3r(@P4P3R-HAK) of 싸이버원

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:02:10.557389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:02:26.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QA-Board",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.8.x (first public release) through 1.0.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "p4p3r(@P4P3R-HAK) of \uc2f8\uc774\ubc84\uc6d0"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Samsung Open Source QA-Board allows : OS Command Injection."
            }
          ],
          "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Samsung Open Source QA-Board allows : OS Command Injection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T01:45:50.377Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Samsung QA-Board \u2014 Unauthenticated OS command injection via output redo/tuning",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110392",
    "datePublished": "2026-10-14T01:35:35.816Z",
    "dateReserved": "2026-10-14T01:30:41.374Z",
    "dateUpdated": "2026-10-14T18:02:26.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85084 (GCVE-0-2026-85084)

Vulnerability from nvd – Published: 2026-09-02 23:21 – Updated: 2026-09-03 13:14

Title

Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

Summary

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 13:14 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-129 - Improper Validation of Array Index

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Samsung/TizenFX/pull/7814	patch
https://github.com/Samsung/TizenFX/pull/7815	patch

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	TizenFX	Unaffected: a74b5e5dd6796f939af8dd90f77a7d9962d67df1

Credits

Ezinne Kalu (https://github.com/zikk090)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T13:14:03.265083Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T13:14:10.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/Samsung/TizenFX",
          "defaultStatus": "unaffected",
          "packageName": "Samsung/TizenFX",
          "product": "TizenFX",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "a74b5e5dd6796f939af8dd90f77a7d9962d67df1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ezinne Kalu (https://github.com/zikk090)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers."
            }
          ],
          "value": "Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T01:18:18.173Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Samsung/TizenFX/pull/7814"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Samsung/TizenFX/pull/7815"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-85084",
    "datePublished": "2026-09-02T23:21:56.514Z",
    "dateReserved": "2026-09-02T23:08:49.435Z",
    "dateUpdated": "2026-09-03T13:14:10.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10420 (GCVE-0-2026-10420)

Vulnerability from nvd – Published: 2026-09-01 11:08 – Updated: 2026-09-14 04:29

Summary

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:15 UTC

CWE

CWE-822 - Untrusted pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/252

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < 102d3dc75cf8e58e68e4bea54ae3c803992c91be (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:15:54.687060Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:16:05.409Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "102d3dc75cf8e58e68e4bea54ae3c803992c91be",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.\u003c/p\u003e"
            }
          ],
          "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "CWE-822 Untrusted pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T04:29:23.260Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/252"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-10420",
    "datePublished": "2026-09-01T11:08:49.869Z",
    "dateReserved": "2026-06-01T01:42:44.323Z",
    "dateUpdated": "2026-09-14T04:29:23.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82927 (GCVE-0-2026-82927)

Vulnerability from nvd – Published: 2026-09-01 10:42 – Updated: 2026-09-21 12:03

Summary

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:18 UTC

CWE

CWE-822 - Untrusted pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/250

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < 06994e303637512e39062f3e037c222e8448e57e (git)

Credits

We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team (PSIRT).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:18:11.507844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:18:27.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "06994e303637512e39062f3e037c222e8448e57e",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team  (PSIRT)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.\u003c/p\u003e"
            }
          ],
          "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "CWE-822 Untrusted pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:03:58.730Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/250"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82927",
    "datePublished": "2026-09-01T10:42:24.285Z",
    "dateReserved": "2026-08-31T11:53:17.414Z",
    "dateUpdated": "2026-09-21T12:03:58.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82926 (GCVE-0-2026-82926)

Vulnerability from nvd – Published: 2026-09-01 10:21 – Updated: 2026-09-21 12:03

Summary

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:18 UTC

CWE

CWE-476 - NULL pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/248

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a (git)

Credits

We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team (PSIRT).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:18:43.514441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:19:57.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar,  and Jo Van Bulck from DistriNet, KU Leuven for reporting this  vulnerability to the Samsung Product Security Incident Response Team  (PSIRT)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.\u003c/p\u003e"
            }
          ],
          "value": "NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:03:49.901Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/248"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82926",
    "datePublished": "2026-09-01T10:21:04.912Z",
    "dateReserved": "2026-08-31T11:53:16.413Z",
    "dateUpdated": "2026-09-21T12:03:49.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82797 (GCVE-0-2026-82797)

Vulnerability from nvd – Published: 2026-08-31 11:28 – Updated: 2026-08-31 14:27

Summary

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 14:27 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/603

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Affected: 0 , < 8de0d9e6ca80ffef654965505981727b9fa06a51 (git)

Credits

Fatullayev Asadbek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:27:09.436917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:27:19.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "8de0d9e6ca80ffef654965505981727b9fa06a51",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Fatullayev Asadbek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\u003cp\u003eThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-230 Serialized Data with Nested Payloads"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T11:31:21.533Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/603"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82797",
    "datePublished": "2026-08-31T11:28:08.147Z",
    "dateReserved": "2026-08-31T02:32:29.811Z",
    "dateUpdated": "2026-08-31T14:27:19.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19588 (GCVE-0-2026-19588)

Vulnerability from nvd – Published: 2026-08-12 02:23 – Updated: 2026-08-12 13:33

Summary

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 13:33 UTC

CWE

CWE-680 - Integer Overflow to Buffer Overflow

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/600

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: 8117b9ee595763f35c0da2c07181203959f0c510

Credits

Yakup Sait Bıyık

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T13:33:16.765391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T13:33:37.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "8117b9ee595763f35c0da2c07181203959f0c510"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yakup Sait B\u0131y\u0131k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers."
            }
          ],
          "value": "Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680 Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T04:02:08.459Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/600"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19588",
    "datePublished": "2026-08-12T02:23:07.478Z",
    "dateReserved": "2026-08-12T02:18:18.508Z",
    "dateUpdated": "2026-08-12T13:33:37.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19587 (GCVE-0-2026-19587)

Vulnerability from nvd – Published: 2026-08-12 02:14 – Updated: 2026-08-12 12:37

Summary

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:36 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/599

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: 87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:36:57.295556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:37:05.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T02:14:59.193Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/599"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19587",
    "datePublished": "2026-08-12T02:14:59.193Z",
    "dateReserved": "2026-08-12T02:07:50.991Z",
    "dateUpdated": "2026-08-12T12:37:05.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19518 (GCVE-0-2026-19518)

Vulnerability from nvd – Published: 2026-08-11 06:27 – Updated: 2026-08-12 00:29

Summary

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:55 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19518",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:55:21.611977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:55:39.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:29:17.567Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19518",
    "datePublished": "2026-08-11T06:27:06.343Z",
    "dateReserved": "2026-08-11T06:10:35.730Z",
    "dateUpdated": "2026-08-12T00:29:17.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19517 (GCVE-0-2026-19517)

Vulnerability from nvd – Published: 2026-08-11 06:23 – Updated: 2026-08-12 00:23

Summary

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:56 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:56:04.240074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:56:19.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:23:21.935Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19517",
    "datePublished": "2026-08-11T06:23:22.926Z",
    "dateReserved": "2026-08-11T06:10:33.363Z",
    "dateUpdated": "2026-08-12T00:23:21.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18772 (GCVE-0-2026-18772)

Vulnerability from nvd – Published: 2026-08-04 08:22 – Updated: 2026-08-12 00:22

Summary

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 13:16 UTC

CWE

CWE-1325 - Improperly controlled sequential memory allocation

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T13:16:08.111242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T13:16:37.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion."
            }
          ],
          "value": "Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-197",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-197 Exponential Data Expansion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:22:22.068Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-18772",
    "datePublished": "2026-08-04T08:22:48.165Z",
    "dateReserved": "2026-08-04T07:17:39.264Z",
    "dateUpdated": "2026-08-12T00:22:22.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15551 (GCVE-0-2026-15551)

Vulnerability from nvd – Published: 2026-07-13 00:11 – Updated: 2026-07-13 15:46

Title

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Summary

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 15:46 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/595

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: bf689b72b8482c5ea674235854bd11b6d1b42588

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T15:46:18.993143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T15:46:29.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "bf689b72b8482c5ea674235854bd11b6d1b42588"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\u003cp\u003eThis issue affects .\u003c/p\u003e"
            }
          ],
          "value": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\n\nThis issue affects ."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T00:11:59.190Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/595"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-15551",
    "datePublished": "2026-07-13T00:11:59.190Z",
    "dateReserved": "2026-07-12T23:55:26.743Z",
    "dateUpdated": "2026-07-13T15:46:29.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58307 (GCVE-0-2026-58307)

Vulnerability from nvd – Published: 2026-07-09 10:33 – Updated: 2026-07-09 12:04

Summary

Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 12:04 UTC

CWE

CWE-125 - Out-of-bounds read
CWE-617 - Reachable assertion

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Samsung/escargot/issues/1577
https://github.com/Samsung/escargot/pull/1586

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Escargot	Affected: 0 , < 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c (git)

Credits

Name: Francesco Lucarini

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T12:04:16.935261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T12:04:20.924Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Samsung/escargot/issues/1577"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Escargot",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "2dee22f5c7b8bf31cb7252d7731fae8c07f2842c",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Name: Francesco Lucarini"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation.\u003cp\u003eThis issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.\u003c/p\u003e"
            }
          ],
          "value": "Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation.\n\nThis issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540 Overread Buffers"
            }
          ]
        },
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617 Reachable assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T10:33:01.635Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/escargot/issues/1577"
        },
        {
          "url": "https://github.com/Samsung/escargot/pull/1586"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-58307",
    "datePublished": "2026-07-09T10:33:01.635Z",
    "dateReserved": "2026-06-30T01:49:44.822Z",
    "dateUpdated": "2026-07-09T12:04:20.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58306 (GCVE-0-2026-58306)

Vulnerability from nvd – Published: 2026-07-09 09:56 – Updated: 2026-07-09 12:10

Summary

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 12:10 UTC

CWE

CWE-122 - Heap-based buffer overflow

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Samsung/escargot/issues/1576
https://github.com/Samsung/escargot/pull/1584

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Escargot	Affected: 0 , < ef525f337fafddecde77a3c426212a84bb20cb98 (git)

Credits

Name: Francesco Lucarini

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T12:10:14.144470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T12:10:29.268Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Escargot",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "ef525f337fafddecde77a3c426212a84bb20cb98",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Name: Francesco Lucarini"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.\u003cp\u003eThis issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.\u003c/p\u003e"
            }
          ],
          "value": "Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.\n\nThis issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T09:56:20.576Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/escargot/issues/1576"
        },
        {
          "url": "https://github.com/Samsung/escargot/pull/1584"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-58306",
    "datePublished": "2026-07-09T09:56:20.576Z",
    "dateReserved": "2026-06-30T01:49:44.822Z",
    "dateUpdated": "2026-07-09T12:10:29.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110934 (GCVE-0-2026-110934)

Vulnerability from cvelistv5 – Published: 2026-10-15 06:51 – Updated: 2026-10-15 14:54

Summary

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:54 UTC

CWE

CWE-129 - Improper validation of array index

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/Vyond/commit/be6e297b0…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Vyond	Affected: 0 , < be6e297b0c4836e20d73b2f8a40a561ea496ebaa (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:54:13.798579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:54:19.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vyond",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "be6e297b0c4836e20d73b2f8a40a561ea496ebaa",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\u003cp\u003eThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.\u003c/p\u003e"
            }
          ],
          "value": "Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\n\nThis issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper validation of array index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:51:21.891Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/Vyond/commit/be6e297b0c4836e20d73b2f8a40a561ea496ebaa"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110934",
    "datePublished": "2026-10-15T06:51:21.891Z",
    "dateReserved": "2026-10-15T06:08:05.108Z",
    "dateUpdated": "2026-10-15T14:54:19.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110933 (GCVE-0-2026-110933)

Vulnerability from cvelistv5 – Published: 2026-10-15 06:51 – Updated: 2026-10-15 14:54

Summary

Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:54 UTC

CWE

CWE-248 - Uncaught exception

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/Vyond/commit/fb10a5c8b…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	Vyond	Affected: 0 , < fb10a5c8b833df7f152d4a563a61d6090a1790d7 (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:54:39.218153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:54:46.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vyond",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "fb10a5c8b833df7f152d4a563a61d6090a1790d7",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\u003cp\u003eThis issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.\u003c/p\u003e"
            }
          ],
          "value": "Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.\n\nThis issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T06:51:04.308Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/Vyond/commit/fb10a5c8b833df7f152d4a563a61d6090a1790d7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110933",
    "datePublished": "2026-10-15T06:51:04.308Z",
    "dateReserved": "2026-10-15T06:08:01.161Z",
    "dateUpdated": "2026-10-15T14:54:46.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110392 (GCVE-0-2026-110392)

Vulnerability from cvelistv5 – Published: 2026-10-14 01:35 – Updated: 2026-10-14 18:02

Title

Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

Summary

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:02 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/qaboard/commit/05789e6…

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	QA-Board	Unaffected: 0.8.x (first public release) through 1.0.1

Credits

p4p3r(@P4P3R-HAK) of 싸이버원

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:02:10.557389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:02:26.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QA-Board",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.8.x (first public release) through 1.0.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "p4p3r(@P4P3R-HAK) of \uc2f8\uc774\ubc84\uc6d0"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Samsung Open Source QA-Board allows : OS Command Injection."
            }
          ],
          "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Samsung Open Source QA-Board allows : OS Command Injection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T01:45:50.377Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Samsung QA-Board \u2014 Unauthenticated OS command injection via output redo/tuning",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-110392",
    "datePublished": "2026-10-14T01:35:35.816Z",
    "dateReserved": "2026-10-14T01:30:41.374Z",
    "dateUpdated": "2026-10-14T18:02:26.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85084 (GCVE-0-2026-85084)

Vulnerability from cvelistv5 – Published: 2026-09-02 23:21 – Updated: 2026-09-03 13:14

Title

Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

Summary

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 13:14 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-129 - Improper Validation of Array Index

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Samsung/TizenFX/pull/7814	patch
https://github.com/Samsung/TizenFX/pull/7815	patch

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	TizenFX	Unaffected: a74b5e5dd6796f939af8dd90f77a7d9962d67df1

Credits

Ezinne Kalu (https://github.com/zikk090)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T13:14:03.265083Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T13:14:10.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/Samsung/TizenFX",
          "defaultStatus": "unaffected",
          "packageName": "Samsung/TizenFX",
          "product": "TizenFX",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "a74b5e5dd6796f939af8dd90f77a7d9962d67df1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ezinne Kalu (https://github.com/zikk090)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers."
            }
          ],
          "value": "Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129 Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T01:18:18.173Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Samsung/TizenFX/pull/7814"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Samsung/TizenFX/pull/7815"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-85084",
    "datePublished": "2026-09-02T23:21:56.514Z",
    "dateReserved": "2026-09-02T23:08:49.435Z",
    "dateUpdated": "2026-09-03T13:14:10.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10420 (GCVE-0-2026-10420)

Vulnerability from cvelistv5 – Published: 2026-09-01 11:08 – Updated: 2026-09-14 04:29

Summary

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:15 UTC

CWE

CWE-822 - Untrusted pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/252

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < 102d3dc75cf8e58e68e4bea54ae3c803992c91be (git)

Credits

Rose-tech-dev (Rose Machocho)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:15:54.687060Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:16:05.409Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "102d3dc75cf8e58e68e4bea54ae3c803992c91be",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rose-tech-dev (Rose Machocho)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.\u003c/p\u003e"
            }
          ],
          "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "CWE-822 Untrusted pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T04:29:23.260Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/252"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-10420",
    "datePublished": "2026-09-01T11:08:49.869Z",
    "dateReserved": "2026-06-01T01:42:44.323Z",
    "dateUpdated": "2026-09-14T04:29:23.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82927 (GCVE-0-2026-82927)

Vulnerability from cvelistv5 – Published: 2026-09-01 10:42 – Updated: 2026-09-21 12:03

Summary

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:18 UTC

CWE

CWE-822 - Untrusted pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/250

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < 06994e303637512e39062f3e037c222e8448e57e (git)

Credits

We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team (PSIRT).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:18:11.507844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:18:27.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "06994e303637512e39062f3e037c222e8448e57e",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team  (PSIRT)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.\u003c/p\u003e"
            }
          ],
          "value": "Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "CWE-822 Untrusted pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:03:58.730Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/250"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82927",
    "datePublished": "2026-09-01T10:42:24.285Z",
    "dateReserved": "2026-08-31T11:53:17.414Z",
    "dateUpdated": "2026-09-21T12:03:58.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82926 (GCVE-0-2026-82926)

Vulnerability from cvelistv5 – Published: 2026-09-01 10:21 – Updated: 2026-09-21 12:03

Summary

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:18 UTC

CWE

CWE-476 - NULL pointer dereference

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/mTower/pull/248

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	mTower	Affected: 0 , < afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a (git)

Credits

We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar, and Jo Van Bulck from DistriNet, KU Leuven for reporting this vulnerability to the Samsung Product Security Incident Response Team (PSIRT).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:18:43.514441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:19:57.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mTower",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We would like to thank Tijs Bellefroid, Antonis Louka, Marton Bognar,  and Jo Van Bulck from DistriNet, KU Leuven for reporting this  vulnerability to the Samsung Product Security Incident Response Team  (PSIRT)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\u003cp\u003eThis issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.\u003c/p\u003e"
            }
          ],
          "value": "NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.\n\nThis issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:03:49.901Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/mTower/pull/248"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82926",
    "datePublished": "2026-09-01T10:21:04.912Z",
    "dateReserved": "2026-08-31T11:53:16.413Z",
    "dateUpdated": "2026-09-21T12:03:49.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82797 (GCVE-0-2026-82797)

Vulnerability from cvelistv5 – Published: 2026-08-31 11:28 – Updated: 2026-08-31 14:27

Summary

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 14:27 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/603

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Affected: 0 , < 8de0d9e6ca80ffef654965505981727b9fa06a51 (git)

Credits

Fatullayev Asadbek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:27:09.436917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:27:19.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "lessThan": "8de0d9e6ca80ffef654965505981727b9fa06a51",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Fatullayev Asadbek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\u003cp\u003eThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-230 Serialized Data with Nested Payloads"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T11:31:21.533Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/603"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-82797",
    "datePublished": "2026-08-31T11:28:08.147Z",
    "dateReserved": "2026-08-31T02:32:29.811Z",
    "dateUpdated": "2026-08-31T14:27:19.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19588 (GCVE-0-2026-19588)

Vulnerability from cvelistv5 – Published: 2026-08-12 02:23 – Updated: 2026-08-12 13:33

Summary

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 13:33 UTC

CWE

CWE-680 - Integer Overflow to Buffer Overflow

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/600

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: 8117b9ee595763f35c0da2c07181203959f0c510

Credits

Yakup Sait Bıyık

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T13:33:16.765391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T13:33:37.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "8117b9ee595763f35c0da2c07181203959f0c510"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yakup Sait B\u0131y\u0131k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers."
            }
          ],
          "value": "Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680 Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T04:02:08.459Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/600"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19588",
    "datePublished": "2026-08-12T02:23:07.478Z",
    "dateReserved": "2026-08-12T02:18:18.508Z",
    "dateUpdated": "2026-08-12T13:33:37.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19587 (GCVE-0-2026-19587)

Vulnerability from cvelistv5 – Published: 2026-08-12 02:14 – Updated: 2026-08-12 12:37

Summary

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:36 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/599

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: 87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:36:57.295556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:37:05.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T02:14:59.193Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/599"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19587",
    "datePublished": "2026-08-12T02:14:59.193Z",
    "dateReserved": "2026-08-12T02:07:50.991Z",
    "dateUpdated": "2026-08-12T12:37:05.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19518 (GCVE-0-2026-19518)

Vulnerability from cvelistv5 – Published: 2026-08-11 06:27 – Updated: 2026-08-12 00:29

Summary

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:55 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19518",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:55:21.611977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:55:39.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:29:17.567Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19518",
    "datePublished": "2026-08-11T06:27:06.343Z",
    "dateReserved": "2026-08-11T06:10:35.730Z",
    "dateUpdated": "2026-08-12T00:29:17.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19517 (GCVE-0-2026-19517)

Vulnerability from cvelistv5 – Published: 2026-08-11 06:23 – Updated: 2026-08-12 00:23

Summary

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:56 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:56:04.240074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:56:19.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:23:21.935Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-19517",
    "datePublished": "2026-08-11T06:23:22.926Z",
    "dateReserved": "2026-08-11T06:10:33.363Z",
    "dateUpdated": "2026-08-12T00:23:21.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18772 (GCVE-0-2026-18772)

Vulnerability from cvelistv5 – Published: 2026-08-04 08:22 – Updated: 2026-08-12 00:22

Summary

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 13:16 UTC

CWE

CWE-1325 - Improperly controlled sequential memory allocation

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/596

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: f487eff2f8086b84ae1c7faa0418abec909e874b

Credits

Alex Williams from Pellera Technologies

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T13:16:08.111242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T13:16:37.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "f487eff2f8086b84ae1c7faa0418abec909e874b"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Williams from Pellera Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion."
            }
          ],
          "value": "Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-197",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-197 Exponential Data Expansion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:22:22.068Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/596"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-18772",
    "datePublished": "2026-08-04T08:22:48.165Z",
    "dateReserved": "2026-08-04T07:17:39.264Z",
    "dateUpdated": "2026-08-12T00:22:22.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15551 (GCVE-0-2026-15551)

Vulnerability from cvelistv5 – Published: 2026-07-13 00:11 – Updated: 2026-07-13 15:46

Title

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Summary

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 15:46 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 55 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/rlottie/pull/595

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	rlottie	Unaffected: bf689b72b8482c5ea674235854bd11b6d1b42588

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T15:46:18.993143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T15:46:29.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rlottie",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "bf689b72b8482c5ea674235854bd11b6d1b42588"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\u003cp\u003eThis issue affects .\u003c/p\u003e"
            }
          ],
          "value": "Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.\n\nThis issue affects ."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T00:11:59.190Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/rlottie/pull/595"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-15551",
    "datePublished": "2026-07-13T00:11:59.190Z",
    "dateReserved": "2026-07-12T23:55:26.743Z",
    "dateUpdated": "2026-07-13T15:46:29.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

132 vulnerabilities by Samsung Open Source

CVE-2026-110934 (GCVE-0-2026-110934)

CVE-2026-110933 (GCVE-0-2026-110933)

CVE-2026-110392 (GCVE-0-2026-110392)

CVE-2026-85084 (GCVE-0-2026-85084)

CVE-2026-10420 (GCVE-0-2026-10420)

CVE-2026-82927 (GCVE-0-2026-82927)

CVE-2026-82926 (GCVE-0-2026-82926)

CVE-2026-82797 (GCVE-0-2026-82797)

CVE-2026-19588 (GCVE-0-2026-19588)

CVE-2026-19587 (GCVE-0-2026-19587)

CVE-2026-19518 (GCVE-0-2026-19518)

CVE-2026-19517 (GCVE-0-2026-19517)

CVE-2026-18772 (GCVE-0-2026-18772)

CVE-2026-15551 (GCVE-0-2026-15551)

CVE-2026-58307 (GCVE-0-2026-58307)

CVE-2026-58306 (GCVE-0-2026-58306)

CVE-2026-110934 (GCVE-0-2026-110934)

CVE-2026-110933 (GCVE-0-2026-110933)

CVE-2026-110392 (GCVE-0-2026-110392)

CVE-2026-85084 (GCVE-0-2026-85084)

CVE-2026-10420 (GCVE-0-2026-10420)

CVE-2026-82927 (GCVE-0-2026-82927)

CVE-2026-82926 (GCVE-0-2026-82926)

CVE-2026-82797 (GCVE-0-2026-82797)

CVE-2026-19588 (GCVE-0-2026-19588)

CVE-2026-19587 (GCVE-0-2026-19587)

CVE-2026-19518 (GCVE-0-2026-19518)

CVE-2026-19517 (GCVE-0-2026-19517)

CVE-2026-18772 (GCVE-0-2026-18772)

CVE-2026-15551 (GCVE-0-2026-15551)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

132 vulnerabilities by Samsung Open Source

CVE-2026-110934 (GCVE-0-2026-110934)

CVE-2026-110933 (GCVE-0-2026-110933)

CVE-2026-110392 (GCVE-0-2026-110392)

CVE-2026-85084 (GCVE-0-2026-85084)

CVE-2026-10420 (GCVE-0-2026-10420)

CVE-2026-82927 (GCVE-0-2026-82927)

CVE-2026-82926 (GCVE-0-2026-82926)

CVE-2026-82797 (GCVE-0-2026-82797)

CVE-2026-19588 (GCVE-0-2026-19588)

CVE-2026-19587 (GCVE-0-2026-19587)

CVE-2026-19518 (GCVE-0-2026-19518)

CVE-2026-19517 (GCVE-0-2026-19517)

CVE-2026-18772 (GCVE-0-2026-18772)

CVE-2026-15551 (GCVE-0-2026-15551)

CVE-2026-58307 (GCVE-0-2026-58307)

CVE-2026-58306 (GCVE-0-2026-58306)

CVE-2026-110934 (GCVE-0-2026-110934)

CVE-2026-110933 (GCVE-0-2026-110933)

CVE-2026-110392 (GCVE-0-2026-110392)

CVE-2026-85084 (GCVE-0-2026-85084)

CVE-2026-10420 (GCVE-0-2026-10420)

CVE-2026-82927 (GCVE-0-2026-82927)

CVE-2026-82926 (GCVE-0-2026-82926)

CVE-2026-82797 (GCVE-0-2026-82797)

CVE-2026-19588 (GCVE-0-2026-19588)

CVE-2026-19587 (GCVE-0-2026-19587)

CVE-2026-19518 (GCVE-0-2026-19518)

CVE-2026-19517 (GCVE-0-2026-19517)

CVE-2026-18772 (GCVE-0-2026-18772)

CVE-2026-15551 (GCVE-0-2026-15551)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.