EUVD-2026-57062
GHSA-q2c3-368x-8j32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Lottie JSON with nested repeaters and max-point polystar shapes
-
DeliveryDeliver file to target user via network or web content
-
ExploitUser opens or triggers rendering in rlottie-backed application
-
ExecutionParser constructs unbounded content tree, charging no allocation budget
-
PersistMemory exhausted across composition rendering
-
ImpactApplication crash or unresponsive device (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector PR:N/UI:R confirms exploitation requires no authentication but does require a user to actively open or render the malicious Lottie animation file. The target application must use an unpatched version of rlottie to process the file. Exploitation is limited to denial of service (crash/resource exhaustion) with no confidentiality or integrity impact. The amplification requires the Lottie file to contain repeater elements (a standard Lottie feature, not a non-default configuration), meaning no special application configuration is needed beyond the library being in use. Exploitation is bounded by available system memory; on memory-constrained embedded devices such as smart TVs, impact may be more severe and recovery may require a reboot. |
| Impact | CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects accurate scoring for a file-parsing DoS: network-reachable, low complexity, unauthenticated, but requiring a user to open the malicious animation. The availability-only impact (A:H, C:N, I:N) confirms this is a crash/DoS scenario with no code execution or data exfiltration. No EPSS data was provided, making statistical exploitation probability unknown. The vulnerability is not in CISA KEV and no public POC has been identified, both reducing urgency. Real-world priority is moderate: rlottie is embedded in Samsung TV and appliance products where Lottie files may be loaded from network sources or user-supplied content; an attacker who can deliver a crafted .json animation to a user's device achieves a denial of service with no further privileges. The fix in PR #599 is confirmed as the upstream resolution, but no tagged release version was provided - downstream consumers must track the commit directly. |
| Exploit ScenarioDerived | An attacker crafts a malicious Lottie JSON file containing deeply nested repeater elements whose child content consists of polystar or custom path shapes with maximum point counts. When a target user opens or views this file in any application backed by rlottie - such as a Samsung smart TV app or embedded device UI - the library's content tree constructor allocates memory proportional to the combinatorial product of nesting levels, repeater copy counts, and shape point counts, exhausting available memory and crashing the application. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to trigger excessive memory allocation, crashing any application that renders it. The root cause is unbounded amplification in the shape/repeater content tree: nested repeaters multiplied by point-heavy shapes (polystar, custom paths) can cause allocations that scale combinatorially with file complexity. All rlottie versions prior to the fix in GitHub PR #599 are affected; no patch release version is independently confirmed. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Upstream fix available via GitHub PR #599 (https://github.com/Samsung/rlottie/pull/599); a released patched version is not independently confirmed - consumers should track the commit directly or await an official tagged release. The fix introduces a global weighted-cost budget of 15,000 units across the composition content tree, preventing repeater and point-shape amplification. As a compensating control, applications embedding rlottie should validate or restrict which Lottie JSON files are permitted to render, blocking files from untrusted network sources or applying a file-size and structural-complexity limit at the application layer before passing content to rlottie. Restricting rendering to Lottie files from known-good, pre-validated sources mitigates the attack surface without requiring a code change, though it limits functionality for applications that render user-supplied animations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rlottie (cpe:2.3:a:samsung_open_source:rlottie:*:*:*:*:*:*:*:*) is Samsung's open-source C++ library for rendering Lottie animations, which are JSON-defined vector animations used across Samsung smart TVs and embedded applications. CWE-400 (Uncontrolled Resource Consumption) describes the root cause: the renderer's content tree construction lacked a global budget limiting how many shape nodes could be allocated during composition parsing. Repeater elements in Lottie can clone their child content multiple times, and when those children are point-heavy shapes such as polystar or custom paths, the allocation cost multiplies (copies × points per shape). Nested repeaters - a repeater whose content contains another repeater - compound this exponentially. The fix (PR #599) introduces a global weighted-cost budget of 15,000 units shared across the entire composition tree, where each node costs at least 1 unit and point-heavy shapes charge their actual point count, capped at 1,024 per polystar. Processing halts when the budget is exhausted.
Know when Samsung Open Source gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered file parsing requires no privileges, but user must open the file (UI:R); impact is availability-only with no code execution path.
Primary rating from Vendor (samsung.tv_appliance).
CVSS VectorVendor: samsung.tv_appliance
DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in Samsung rlottie Resource and Overflow Vulnerabilities
View all 2More in Samsung Open Source
View allOS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operat
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Exploit-DB