Executive brief
Samsung's rlottie is an open-source animation rendering library used in mobile and web applications. A malformed animation file can trigger excessive allocation of memory and processing resources through improper validation of input quantities in precomp nesting, repeater counts, and polystar shapes, potentially causing denial of service or application crashes.
Technical details
The vulnerability is a resource exhaustion issue stemming from improper validation of input quantities and lack of allocation throttling in the rlottie animation rendering engine. Specifically, the library failed to enforce bounds on precomp nesting depth, total render-node counts in wide precomp graphs, repeater copy counts, and polystar point validation. An attacker can craft a malicious Lottie animation file with deeply nested structures or excessively large quantities that, when parsed and rendered, cause unbounded memory allocation and CPU consumption. This requires the application to parse and render the malicious animation file (user interaction), but no authentication is needed. The attack results in denial of service through resource exhaustion, potentially crashing the application or consuming all available system resources. The fix, merged in July 2026, introduces safety limits and validation checks for all vulnerable input parameters.
Affected products
- Samsung rlottie versions prior to the fix (post-July 2026)
Timeline
- 2026-08-11: disclosed
- 2026-07-22: patched: Safety limits patch merged to master branch