Executive brief
Samsung's rlottie is a popular animation rendering library used to display Lottie animations in applications. An uncontrolled resource consumption vulnerability allows attackers to craft malicious animation files that trigger excessive memory allocation and CPU usage, potentially causing application crashes or denial of service.
Technical details
The vulnerability exists in rlottie's repeater and shape rendering logic. Repeaters can multiply a shape by up to 10,000 copies, and each shape can contain up to 1,024 points; nesting repeaters or combining these features allows an attacker to trigger exponential rendering work per frame, exhausting system resources. The root cause is the absence of a shared budget constraint across repeater multiplication and shape complexity. Attack vector is network/local file-based (via malicious .json animation files), requiring no authentication. An attacker can cause application hangs, crashes, or denial of service by crafting animation files with extreme repeater nesting or high-complexity shapes. Mitigation was introduced in a patch (PR #599) that adds a 15,000-point shared budget across shape building, preventing runaway resource allocation.
Affected products
- Samsung rlottie
Timeline
- 2026-08-12: disclosed
- 2026-08-06: patched: Fix merged in PR #599 prior to public disclosure