Executive brief
Samsung's rlottie is an open-source animation rendering library used in applications to display Lottie animations. A vulnerability in how the library validates input quantities allows attackers to supply specially crafted animation files that trigger excessive resource consumption, potentially causing application crashes or denial of service through memory exhaustion or processing overload.
Technical details
The vulnerability is an improper validation flaw affecting precomp nesting depth, repeater copy counts, render-tree node counts, and polystar point validation in Samsung's rlottie animation library. Attackers can craft malicious Lottie animation files with deeply nested structures, oversized graphs, or invalid point counts that bypass input validation, leading to unbounded resource consumption. The attack requires only network access to deliver the malicious file and no authentication or special privileges. A successful exploit causes denial of service through memory exhaustion or excessive CPU usage when the animation is parsed and rendered. The vulnerability was patched in July 2026 (GitHub PR #596) by introducing bounds on nesting depth, render-node counts, repeater multiplicity, and polystar geometry validation.
Affected products
- Samsung rlottie unspecified
Timeline
- 2026-08-11: disclosed
- 2026-07-22: patched: Fix merged in GitHub PR #596