Quick answers
- Is CVE-2026-19587 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19587 being exploited in the wild.
- How severe is CVE-2026-19587?
- Medium severity, with a CVSS score of 6.5, published 12 August 2026.
- Which products and versions are affected?
- Samsung rlottie.
- Is there a fix for CVE-2026-19587?
- A patch was published on 2026-08-06: Fix merged in PR #599 prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19587 attacked?
- It is attacked over the network or with local access.
- Am I affected by CVE-2026-19587?
- Check whether you run Samsung Rlottie. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in rlottie's repeater and shape rendering logic. Repeaters can multiply a shape by up to 10,000 copies, and each shape can contain up to 1,024 points; nesting repeaters or combining these features allows an attacker to trigger exponential rendering work per frame, exhausting system resources. The root cause is the absence of a shared budget constraint across repeater multiplication and shape complexity. Attack vector is network/local file-based (via malicious .json animation files), requiring no authentication. An attacker can cause application hangs, crashes, or denial of service by crafting animation files with extreme repeater nesting or high-complexity shapes. Mitigation was introduced in a patch (PR #599) that adds a 15,000-point shared budget across shape building, preventing runaway resource allocation.
Affected products
- Samsung rlottie
Timeline
- 2026-08-12: disclosed
- 2026-08-06: patched: Fix merged in PR #599 prior to public disclosure