rlottie CVE-2026-82797

Exploitation requires that a victim user opens or causes their application to render a crafted Lottie animation file containing shape-group trees nested more than 32 levels deep. This is a local file-processing attack (AV:L, UI:R): no network service is exposed and no remote unauthenticated path exists. The flaw is triggered through the normal Lottie file-parsing codepath in rlottie, meaning any application that auto-renders received Lottie/JSON animation data (e.g., messaging apps displaying stickers from external sources) faces elevated risk because user interaction is implicitly satisfied by receiving the file. Exploitation is limited to denial-of-service (application crash); no code execution or data access is indicated by the CVSS impact metrics (C:N/I:N/A:H). The attack does not require elevated privileges.

The CVSS 3.1 score of 5.5 Medium reflects a local attack vector (AV:L) requiring user interaction (UI:R) with no privileges needed (PR:N), scoped to availability only (C:N/I:N/A:H). Real-world risk is accordingly limited: an attacker cannot trigger this remotely over a network; a victim must open a malicious animation file. No EPSS data was provided in the input; given the absence of KEV listing and no public exploit, opportunistic mass exploitation is unlikely. The purely availability-focused impact (application crash, no data exfilteration) and the local-file delivery requirement further reduce urgency outside of contexts where untrusted Lottie files are automatically parsed - such as messaging apps rendering received stickers or UI toolkits loading third-party animations. The mislabeled 'Information Disclosure' tag in the input is inconsistent with CVSS C:N and should not influence risk decisions.

An attacker crafts a Lottie animation JSON file containing shape-group nodes nested beyond 32 levels and delivers it to a victim - for example, as a messaging sticker, a UI theme asset, or an email attachment. When the victim's application (embedding an unpatched rlottie build) renders or previews the file, the parser recurses without bound, exhausts the call stack, and crashes the application. No public proof-of-concept code has been identified at time of analysis, but the fix diff makes the triggering condition trivially reproducible.