rlottie CVE-2026-47318

Exploitation requires two concrete conditions: (1) the target user must open or trigger rendering of a specially crafted Lottie animation file (UI:R confirmed by CVSS vector), and (2) the application embedding rlottie must process the file using a version prior to commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035. The attack vector is local (AV:L per CVSS), meaning the attacker must first deliver the malicious .json file to the target's accessible filesystem - for example, via a download, shared media, or embedded asset. No attacker authentication is required (PR:N per CVSS), but the victim's interaction is mandatory. Exploitation is further limited by the need for a specifically constructed Bezier curve that exhausts the 31-subdivision depth limit of bez_stack, and by platform-level stack protections (canaries, ASLR) that significantly reduce the likelihood of reliable code execution beyond a denial-of-service crash. Non-default configurations are not required - any application that renders an attacker-controlled Lottie file is exposed.

CVSS 6.1 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), no required privileges (PR:N), mandatory user interaction (UI:R), unchanged scope (S:U), high availability impact (A:H), low integrity impact (I:L), and no confidentiality impact (C:N). The primary realistic outcome is a denial-of-service crash of the hosting application; stack-based code execution is theoretically possible but significantly constrained by modern mitigations (stack canaries, ASLR, non-executable stacks) present on most deployment targets. No EPSS score was provided in the source data, preventing a probability-based comparison. The CVE is not in CISA KEV and no POC is publicly identified, indicating no confirmed widespread or active exploitation. The risk is most meaningful for applications that ingest Lottie files from untrusted external sources (e.g., messaging platforms, media players, web-connected TV UIs). CVSS indicates network delivery of the malicious file is possible, but the attack vector is local - the attacker must place the crafted file on the target's filesystem first, which is the primary limiting factor.

An attacker crafts a malicious Lottie animation JSON file embedding a cubic Bezier path engineered to require more than 31 levels of recursive subdivision during rasterization. The file is delivered to the victim - via download link, messaging attachment, or embedded in a web page - and the victim opens it in an application (such as a Samsung TV app or a messaging client) that uses a vulnerable version of rlottie. During rendering, gray_render_cubic overflows the bez_stack array, triggering an application crash; on platforms without stack canaries, controlled memory corruption may be possible. No public POC exists at time of analysis.