Samsung rlottie CVE-2026-19517

A user or application must actively render a crafted Lottie animation file (JSON format). This requires UI:R as confirmed by the CVSS vector. The attacker has no authentication requirement (PR:N) but cannot exploit the flaw autonomously - the malicious file must be opened or triggered for rendering by the target. Exploitation is limited to contexts where the application ingests Lottie files from untrusted or attacker-controlled sources (e.g., user-uploaded content, remotely fetched animation assets, messaging stickers). Applications that only render Lottie files from a trusted, vendor-controlled source are not realistically at risk. There is no requirement for any specific non-default configuration beyond the library being in use.

CVSS 6.5 with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects the risk profile: the attack is network-delivered and low-complexity, but requires user interaction - the victim application must actually render the crafted Lottie file. The availability impact is high (resource exhaustion leading to crash or hang), while confidentiality and integrity are unaffected. The 'Information Disclosure' tag in the source data appears to be a tagging error; the CVSS vector and PR diff confirm a pure availability/DoS impact with no data exposure. No EPSS data was provided, and the vulnerability is not in CISA KEV. Given that rlottie is embedded in consumer and enterprise Samsung products including Smart TVs and Tizen, and is also used by third-party applications (notably Telegram for animated stickers), the real-world reach is broader than the Samsung-branded attribution suggests. The UI:R requirement meaningfully reduces automated exploitation risk, but in any context where animated content is routinely opened from untrusted sources - messaging apps, web embeds, media players - exploitation becomes practical with minimal attacker effort.

An attacker crafts a Lottie JSON animation file containing deeply nested precomposition layers (exceeding 32 levels), a Repeater element with a multi-million copy count, and polystar shapes with non-finite point values. The file is delivered via a messaging platform, email attachment, or embedded in a web page. When the target application renders the animation - for example, a Telegram-style animated sticker or a Samsung TV interface element - the library begins allocating render nodes and recursive layer items without bound, exhausting available memory and crashing or hanging the host process.