Executive brief
Samsung's rlottie is an open-source animation rendering library used by applications to display vector animations. A serialized animation file with deeply nested shape groups can trigger unbounded recursion during parsing, exhausting memory and crashing the application. This could be exploited by delivering a malicious animation file to cause denial of service.
Technical details
The vulnerability is an uncontrolled recursion flaw in the shape group parsing logic of rlottie. The parseGroupObject function recursively processes nested "gr" (group) objects without enforcing a depth limit, allowing an attacker to craft a serialized animation payload with arbitrarily deep nesting. An application processing such a file will exhaust the call stack and crash. The fix applies a maximum nesting depth limit of 32 to the recursive parsing, halting traversal of deeper content. Network or local delivery of a malicious animation file is required; no authentication is needed.
Affected products
- Samsung rlottie before 8de0d9e6ca80ffef654965505981727b9fa06a51
Timeline
- 2026-08-31: disclosed
- 2026-08-19: patched: Fix merged in PR #603