Executive brief
Samsung's rlottie is an open-source library used to render vector animations (Lottie files) on various platforms, including mobile devices and smart TVs. A vulnerability in how the library handles complex or malformed animation files could allow an attacker to crash applications using the library or potentially manipulate memory. This could lead to service disruptions or application instability if a user is tricked into opening a specially crafted animation file.
Technical details
The vulnerability consists of two primary issues within the Samsung rlottie library. First, a missing guard in the Property::value() method in lottiemodel.h allows for an uninitialized or null pointer dereference when animation keyframes are discarded during parsing. Second, the Layer::matrix() method in lottieitem.cpp lacks depth limiting, leading to uncontrolled recursion and potential stack overflow when processing cyclic parent layer references. An attacker can exploit these by providing oversized or malformed serialized data payloads (Lottie files). Exploitation requires a user to open a malicious file (User Interaction: Required) and can result in a Denial of Service (DoS) or limited memory corruption. The issues were addressed by adding empty-frame guards and implementing a recursion depth limit of 64 levels.
Affected products
- Samsung rlottie before eae37633fda13ac05b25c6c95aacea4bc33c80a3
Timeline
- 2026-06-01: patched: Fixes submitted via GitHub Pull Request 593
- 2026-06-04: disclosed: CVE published to NVD