Quick answers
- Is CVE-2026-19517 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19517 being exploited in the wild.
- How severe is CVE-2026-19517?
- Medium severity, with a CVSS score of 6.5, published 11 August 2026.
- Which products and versions are affected?
- Samsung Rlottie versions prior to the fix (post-July 2026).
- Is there a fix for CVE-2026-19517?
- A patch was published on 2026-07-22: Safety limits patch merged to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19517 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19517?
- Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a resource exhaustion issue stemming from improper validation of input quantities and lack of allocation throttling in the rlottie animation rendering engine. Specifically, the library failed to enforce bounds on precomp nesting depth, total render-node counts in wide precomp graphs, repeater copy counts, and polystar point validation. An attacker can craft a malicious Lottie animation file with deeply nested structures or excessively large quantities that, when parsed and rendered, cause unbounded memory allocation and CPU consumption. This requires the application to parse and render the malicious animation file (user interaction), but no authentication is needed. The attack results in denial of service through resource exhaustion, potentially crashing the application or consuming all available system resources. The fix, merged in July 2026, introduces safety limits and validation checks for all vulnerable input parameters.
Affected products
- Samsung rlottie versions prior to the fix (post-July 2026)
Timeline
- 2026-08-11: disclosed
- 2026-07-22: patched: Safety limits patch merged to master branch