Executive brief
Samsung rlottie is an open-source library used to render vector animations (Lottie files) on various platforms, including mobile devices and smart appliances. A vulnerability in how it processes animation files allows a specially crafted file to crash the application. This could lead to a denial-of-service, causing apps or device interfaces that display these animations to stop working or restart unexpectedly.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in Samsung's rlottie library due to improper handling of circular asset references within Lottie JSON files. Specifically, a malicious file containing self-referencing or mutually referencing 'precomp' assets triggers infinite recursion in renderer::CompLayer::CompLayer() via createLayerItem(). This exhaustion of stack space results in a SIGSEGV crash. The attack requires a user to open or load a specially crafted animation file. The issue was addressed by implementing a directed asset dependency graph and using Breadth-First Search (BFS) to detect and skip cyclic dependencies during the layer resolution phase.
Affected products
- Samsung rlottie before commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945
Timeline
- 2026-04-28: disclosed: Vulnerability details and fix proposed in GitHub pull request
- 2026-05-12: patched: Fix merged into master branch
- 2026-06-04: advisory: CVE-2026-47306 published