CVE-2026-49509: Heap Out-of-Bounds Read in stbi__process_frame_header() - Samsung rlottie

Sep 3, 2026

Details

Description

An out-of-bounds read vulnerability (CWE-125) exists in the JPEG decoder of the stb_image copy vendored by Samsung rlottie (v2.19, src/vector/stb/stb_image.h). The decoder accepts JPEG component sampling factors that do not evenly divide the maximum factors (fractional subsampling ratios). Because the per-component buffers and resamplers are sized under the integer-ratio assumption, a JPEG declaring sampling factors such as Y(2x2), Cb(3x3), Cr(3x3) triggers a heap-buffer-overflow read during YCbCr-to-RGB conversion.

Upstream stb fixed this in July 2021 (nothings/stb issue #1178, commit 5ba0baa “stb_image: Reject fractional JPEG component subsampling ratios”, first included in stb v2.28); the copy vendored in rlottie predates that fix, and to the reporter’s knowledge no CVE had previously been assigned to this bug.

The embedded image is decoded during parsing (Asset::loadImageData via LottieParserImpl::parseAsset), so any application that loads untrusted Lottie animations (e.g. stickers) is exposed — no layer needs to reference the asset. Impact is an out-of-bounds heap read: hardened builds abort (DoS), and in ordinary builds the out-of-bounds heap bytes can end up rendered in the output frame (potential information disclosure).

Attack Vectors

The victim opens or processes a crafted Lottie file whose image asset is a JPEG declaring non-integral component sampling factors (e.g. Y(2x2), Cb(3x3), Cr(3x3)). The image is decoded during parsing, before any layer references the asset, so simply loading the animation triggers the out-of-bounds read.

Steps to Reproduce

  1. Craft a Lottie file containing an image asset whose embedded JPEG declares component sampling factors Y(2x2), Cb(3x3), Cr(3x3) in its SOF frame header.

  2. Load the file with an AddressSanitizer-instrumented rlottie build

    auto animation = rlottie::Animation::loadFromFile("poc.json");

  3. ASAN reports a heap-buffer-overflow read of size 8 in stbi__YCbCr_to_RGB_simd during parsing.

Proof of Concept

AddressSanitizer Output (rlottie master, commit 27f2f23)

ERROR: AddressSanitizer: heap-buffer-overflow
    READ of size 8
        #1 stbi__YCbCr_to_RGB_simd       src/vector/stb/stb_image.h:3452
        #10 Asset::loadImageData         src/lottie/lottiemodel.cpp:375
        #11 LottieParserImpl::parseAsset src/lottie/lottieparser.cpp:1018
        #17 rlottie::Animation::loadFromFile src/lottie/lottieanimation.cpp:319

Remediation

Update the vendored stb_image to v2.28 or later, or backport the upstream check (nothings/stb commit 5ba0baa) into stbi__process_frame_header() (src/vector/stb/stb_image.h:3038):

for (i=0; i < s->img_n; ++i) {
   if (h_max % z->img_comp[i].h != 0) return stbi__err("bad H", "Corrupt JPEG");
   if (v_max % z->img_comp[i].v != 0) return stbi__err("bad V", "Corrupt JPEG");
}

Samsung applied this fix in Samsung/rlottie PR #604, merged into master on 2026-09-01.

References