CVE-2026-49509

MediumCVSS 4.4/10Last modified Sep 8, 2026

Description

Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers.

This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-49515.1The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defiCVE-2026-495106.1Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 2129CVE-2026-49525.1The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business rCVE-2026-49537.3A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/CVE-2026-49546.3A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/wCVE-2026-49557.3A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the file /OperateStatisCVE-2026-49567.3A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file CVE-2026-49572.7A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/funcCVE-2026-49586.5A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the fileCVE-2026-49597.5A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/sharCVE-2026-49608.8A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the cCVE-2026-49618.8A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/Q
CVE-2026-49509: Medium severity, CVSS 4.4 | Vulnix