# CVE-2026-19587: Samsung rlottie uncontrolled resource consumption via repeater budget

Source: https://junglewise.ai/threats/cve-2026-19587-samsung-rlottie-uncontrolled-resource-consumption-via-repeater  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19587 · Severity: medium · CVSS 6.5 · Published 2026-08-12

Samsung's rlottie is a popular animation rendering library used to display Lottie animations in applications. An uncontrolled resource consumption vulnerability allows attackers to craft malicious animation files that trigger excessive memory allocation and CPU usage, potentially causing application crashes or denial of service.

Technologies: [Samsung Rlottie](https://junglewise.ai/threats/technologies/rlottie). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-19587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19587 being exploited in the wild.

**How severe is CVE-2026-19587?** Medium severity, with a CVSS score of 6.5, published 12 August 2026.

**Which products and versions are affected?** Samsung rlottie.

**Is there a fix for CVE-2026-19587?** A patch was published on 2026-08-06: Fix merged in PR #599 prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19587 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-19587?** Check whether you run Samsung Rlottie. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in rlottie's repeater and shape rendering logic. Repeaters can multiply a shape by up to 10,000 copies, and each shape can contain up to 1,024 points; nesting repeaters or combining these features allows an attacker to trigger exponential rendering work per frame, exhausting system resources. The root cause is the absence of a shared budget constraint across repeater multiplication and shape complexity. Attack vector is network/local file-based (via malicious .json animation files), requiring no authentication. An attacker can cause application hangs, crashes, or denial of service by crafting animation files with extreme repeater nesting or high-complexity shapes. Mitigation was introduced in a patch (PR #599) that adds a 15,000-point shared budget across shape building, preventing runaway resource allocation.

## Affected products

- Samsung rlottie

## Timeline

- 2026-08-12: disclosed
- 2026-08-06: patched: Fix merged in PR #599 prior to public disclosure

## References

- [https://github.com/Samsung/rlottie/pull/599](https://github.com/Samsung/rlottie/pull/599)

## Related threats

- [Samsung rlottie heap-based buffer overflow via environment variables](https://junglewise.ai/threats/cve-2026-108978-heap-based-buffer-overflow-vulnerability-in-samsung-opensource)
- [Samsung rLottie stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-91826-samsung-rlottie-stack-based-buffer-overflow)
- [Samsung rLottie out-of-bounds read in stb_image](https://junglewise.ai/threats/cve-2026-49509-samsung-rlottie-out-of-bounds-read-in-stb-image)
- [Samsung rlottie uncontrolled recursion in shape group parsing](https://junglewise.ai/threats/cve-2026-82797-samsung-rlottie-uncontrolled-recursion-in-shape-group-parsing)
- [Samsung rlottie integer overflow to buffer overflow](https://junglewise.ai/threats/cve-2026-19588-samsung-rlottie-integer-overflow-to-buffer-overflow)