Samsung rlottie CVE-2026-19518

Exploitation requires that the target application embeds the rlottie library and renders Lottie animation content that is influenced by the attacker. The vulnerability triggers during the parsing and rendering phases when the animation contains any of the following: (1) precomposition (CompLayer) nesting deeper than 32 levels, (2) a total render-node count exceeding 100,000, (3) a Repeater element with a very large or non-finite mMaxCopies value, or (4) polystar or polygon shape elements with non-finite or less-than-1 point values. User interaction is required per CVSS UI:R - a user or automated process must load the crafted animation file. No authentication is required to deliver the payload (PR:N), but the attacker must control or influence the Lottie content rendered by the target (e.g., via a malicious file upload, a compromised CDN, or a URL pointing to attacker-hosted animation data). Exploitation is limited to availability impact; the CVSS vector (C:N/I:N) and patch diff provide no indication of code execution or data disclosure capability.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately characterizes a remotely deliverable, low-complexity DoS requiring only that a user or automated pipeline render a malicious Lottie file. Scope is unchanged (S:U), confining impact to the rlottie rendering process rather than enabling broader system compromise. EPSS data was not provided in the available intelligence, so an exploitation probability percentage cannot be stated. The vulnerability is not listed in CISA KEV, and no standalone public exploit code has been identified - only the upstream patch PR, whose diff implicitly confirms the exploitable code paths. Notably, the input tags include 'Information Disclosure,' which is inconsistent with the CVSS vector's C:N and I:N ratings and with the patch diff, which addresses only resource-exhaustion inputs; this tag discrepancy should be verified with Samsung before using it for classification. Real-world risk is moderate: exploitation requires influencing the Lottie content rendered by a target application, which is a meaningful prerequisite, but rlottie is embedded in Samsung TV appliances and potentially consumer devices where animation parsing may occur automatically on content load.

An attacker crafts a Lottie JSON animation file containing precomposition layers nested beyond 32 levels or a Repeater element with a non-finite copy count, then delivers it to a target via a malicious website, a compromised content-delivery source, or a file upload endpoint. When the target application passes the file to rlottie for rendering - triggered by user action or automated content loading - the missing depth and budget guards cause a stack overflow or extreme resource exhaustion, crashing or hanging the host process. No standalone public exploit code exists, but the PR diff provides sufficient technical detail to reconstruct triggering inputs.