lottie-android CVE-2026-95179

The host application must parse an attacker-controlled Lottie animation JSON containing a cyclic precomposition reference graph; the recursion occurs in BaseLayer.forModel and CompositionLayer during model/layer-tree construction. The decisive limiting factor is input trust: exploitation requires the app to load untrusted/remote animation files - applications that render only bundled, trusted animations are not exposed. No authentication (PR:N) and no explicit user interaction beyond rendering are required, but delivery of the malicious JSON to the parser is a hard prerequisite; impact is limited to crashing/hanging the application (availability only).

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a purely availability-impacting, unauthenticated, network-reachable denial of service with no confidentiality or integrity effect, consistent with the CWE-674 (uncontrolled recursion) root cause. No EPSS score, KEV listing, or explicit POC flag was supplied in the input, so there is no public-exploit or active-exploitation signal to corroborate the high base score; the only exploitation-relevant artifact is a third-party security advisory (FFG0d) and a remediation PR. A key caveat: lottie-android is a client-side rendering library embedded in applications, so the 'network' attack vector only holds when the host application loads attacker-controlled animation JSON - the CVSS AV:N therefore reflects a worst-case data-delivery assumption rather than a directly listening network service, which should be verified against actual deployment. Realistically this is a moderate-priority, impact-limited (crash/hang only) DoS bug rather than a top-tier emergency: high CVSS driven entirely by A:H, but no privilege escalation, no code execution, and no confirmed in-the-wild use. Note also that the supplied source-code evidence is a fix in Samsung's rlottie (a C++ sibling project), not in airbnb/lottie-android itself - cross-ecosystem fix, so the Java/Kotlin patch status should be confirmed independently.

An application using lottie-android loads an animation JSON from an untrusted source (e.g., a remote URL, user upload, or ad/content payload). The attacker supplies a Lottie file whose precomposition layers reference each other cyclically, so BaseLayer.forModel / CompositionLayer recurse without bound and exhaust the stack, crashing or hanging the host app. No authentication or user interaction beyond rendering the malicious animation is required; no public exploit code was identified in the provided data, though a third-party security advisory exists.