CVE-2026-47306: rlottie Uncontrolled Recursion Denial-of-Service Vulnerability

Technical summary

CVE-2026-47306 is an uncontrolled recursion vulnerability (CWE-674) in rlottie, Samsung's open-source animation rendering library. The flaw exists in the parsing and deserialization logic when handling oversized payloads. The recursion mechanism lacks adequate depth guards, allowing an attacker to craft a Lottie animation file that, upon deserialization, causes the parser to recurse infinitely or until stack exhaustion. The vulnerability was resolved in commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945. CVSS 3.1 score of 6.1 reflects the local attack vector and high availability impact combined with low integrity risk.

Business impact

Applications embedding rlottie for animation playback face denial-of-service risk. Mobile apps, UI frameworks, and media players that process user-supplied or untrusted Lottie files can be crashed by a single malicious payload. While integrity and confidentiality are not compromised, availability damage can degrade user experience and, in automated environments, disrupt service continuity. Organizations relying on rlottie in customer-facing or backend animation processing should assess whether user-submitted animation files are part of their threat model.

Affected systems

Samsung rlottie library versions prior to commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 are vulnerable. This includes any application or framework that vendors rlottie for animation rendering. The scope is local; the attack surface is limited to systems that parse untrusted Lottie animation files. No specific downstream products or version numbers have been disclosed as affected; vendors and product teams must verify their own rlottie dependency versions.

Exploitability

Exploitability is straightforward for an attacker with the ability to supply a crafted Lottie file to a vulnerable application. The attack requires user interaction—a user must open, import, or process the malicious animation. No authentication, elevated privileges, or network access is required. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms low complexity; once a user encounters the payload, crash is likely. However, active wild exploitation has not been reported, and the vulnerability is not on the CISA KEV list.

Remediation

Update rlottie to the patched version incorporating commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 or later. Organizations should verify their dependency tree to identify all products and services embedding rlottie and coordinate updates accordingly. For applications that accept user-supplied animation files, input validation and sandboxing of the parsing process can reduce impact while patches are deployed.

Patch guidance

Identify all instances of rlottie in your codebase via dependency scanning tools. Contact your library or framework vendor to confirm the patched version availability for your deployment context (web, mobile, embedded). The fix addresses recursion depth validation; confirm patch notes explicitly mention CWE-674 remediation. Test patches in a staging environment with existing Lottie file workflows before production rollout. If you are a vendor integrating rlottie, publish guidance for your customers on required updates and timelines.

Detection guidance

Monitor for application crashes or high CPU usage coinciding with animation file processing or Lottie imports. Stack traces showing recursive function calls within rlottie's parsing layers are indicative. In memory-constrained environments (mobile, IoT), monitor for out-of-memory errors during animation load. If forensic analysis is possible, examine the triggering animation file for unusual recursion patterns or excessive payload sizes. Intrusion detection signatures should flag unusually large or deeply nested JSON structures in .json Lottie files if scanned at ingestion.

Why prioritize this

CVSS 6.1 (MEDIUM) reflects high availability impact offset by local attack surface and user interaction requirement. Prioritize based on your use of rlottie and exposure to untrusted animation sources. If rlottie is embedded in customer-facing mobile apps or web tools accepting user uploads, treat as high priority within your patch cycle. If rlottie use is limited to internal, trusted animation assets, prioritization can be moderate. The absence of KEV listing and active wild exploitation suggests this is not an immediate nation-state or ransomware vector, but should not be deprioritized indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) is driven by: (1) high availability impact (A:H)—confirmed crash and service disruption—balanced against (2) no confidentiality or integrity breach (C:N/I:L), and (3) local attack surface (AV:L) requiring a user to process the file (UI:R). The score appropriately reflects a denial-of-service risk that is serious for availability-critical services but does not expose data or enable privilege escalation. Organizational risk may be higher if animation processing is part of a critical pipeline.

Frequently asked questions