# CVE-2026-19518: Samsung rlottie improper input validation in animation handling

Source: https://junglewise.ai/threats/cve-2026-19518-samsung-rlottie-improper-input-validation-in-animation-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19518 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Samsung's rlottie is an open-source animation rendering library used in applications to display Lottie animations. A vulnerability in how the library validates input quantities allows attackers to supply specially crafted animation files that trigger excessive resource consumption, potentially causing application crashes or denial of service through memory exhaustion or processing overload.

Technologies: [Samsung Rlottie](https://junglewise.ai/threats/technologies/rlottie). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-19518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19518 being exploited in the wild.

**How severe is CVE-2026-19518?** Medium severity, with a CVSS score of 6.5, published 11 August 2026.

**Which products and versions are affected?** Samsung Rlottie unspecified.

**Is there a fix for CVE-2026-19518?** A patch was published on 2026-07-22: Fix merged in GitHub PR #596 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19518 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19518?** Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper validation flaw affecting precomp nesting depth, repeater copy counts, render-tree node counts, and polystar point validation in Samsung's rlottie animation library. Attackers can craft malicious Lottie animation files with deeply nested structures, oversized graphs, or invalid point counts that bypass input validation, leading to unbounded resource consumption. The attack requires only network access to deliver the malicious file and no authentication or special privileges. A successful exploit causes denial of service through memory exhaustion or excessive CPU usage when the animation is parsed and rendered. The vulnerability was patched in July 2026 (GitHub PR #596) by introducing bounds on nesting depth, render-node counts, repeater multiplicity, and polystar geometry validation.

## Affected products

- Samsung rlottie unspecified

## Timeline

- 2026-08-11: disclosed
- 2026-07-22: patched: Fix merged in GitHub PR #596

## References

- [https://github.com/Samsung/rlottie/pull/596](https://github.com/Samsung/rlottie/pull/596)

## Related threats

- [Samsung rlottie heap-based buffer overflow via environment variables](https://junglewise.ai/threats/cve-2026-108978-heap-based-buffer-overflow-vulnerability-in-samsung-opensource)
- [Samsung rLottie stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-91826-samsung-rlottie-stack-based-buffer-overflow)
- [Samsung rLottie out-of-bounds read in stb_image](https://junglewise.ai/threats/cve-2026-49509-samsung-rlottie-out-of-bounds-read-in-stb-image)
- [Samsung rlottie uncontrolled recursion in shape group parsing](https://junglewise.ai/threats/cve-2026-82797-samsung-rlottie-uncontrolled-recursion-in-shape-group-parsing)
- [Samsung rlottie integer overflow to buffer overflow](https://junglewise.ai/threats/cve-2026-19588-samsung-rlottie-integer-overflow-to-buffer-overflow)