CVE-2026-47306: Samsung rlottie DoS Vulnerability

CVE-2026-47306 Overview

CVE-2026-47306 is an uncontrolled recursion vulnerability [CWE-674] in Samsung's open-source rlottie library. The flaw triggers when the library parses oversized serialized data payloads, causing recursive calls that exhaust available stack space. Successful exploitation results in application crashes and denial of service on the host process.

The vulnerability affects rlottie versions prior to commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945. Exploitation requires local access and user interaction, such as opening a crafted Lottie animation file in an application that links against the vulnerable library.

Critical Impact
A crafted Lottie payload can crash any application embedding the vulnerable rlottie parser, disrupting availability of animation-rendering features and parent processes.

Affected Products

Samsung rlottie open-source animation library
All builds prior to commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945
Downstream applications statically or dynamically linking the vulnerable rlottie versions

Discovery Timeline

2026-06-04 - CVE-2026-47306 published to the National Vulnerability Database (NVD)
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-47306

Vulnerability Analysis

The vulnerability stems from unbounded recursive parsing inside the rlottie deserialization code path. Lottie animation files use nested JSON-like structures that describe layers, shapes, and effects. The parser recursively descends into each nested node without enforcing a depth limit or input size ceiling.

An attacker crafts a serialized payload with deeply nested elements. When the application loads this file, the parser issues a recursive call for each nested level. Stack frames accumulate until the thread exhausts its stack region and the process terminates with a segmentation fault.

The issue is classified as Uncontrolled Recursion [CWE-674]. Impact is limited to availability, since the crash does not directly expose memory contents or grant code execution. Confidentiality remains intact, while integrity exposure is minimal.

Root Cause

The parser lacks a maximum recursion depth check and does not validate the structural size of incoming serialized data before descending into child nodes. Any user-supplied animation file with sufficient nesting will exceed thread stack limits.

Attack Vector

An attacker delivers a malicious Lottie file to a local user. The user opens or imports the file in an application that embeds rlottie. Parsing begins, recursion runs unbounded, and the host process crashes. Network delivery vectors are possible but exploitation requires the file to be processed locally by the vulnerable parser.

No proof-of-concept code is published for this CVE. See the upstream fix in Samsung/rlottie pull request #585 for the corrective patch.

Detection Methods for CVE-2026-47306

Indicators of Compromise

Repeated crashes or segmentation faults in processes that load .json or .lottie animation files
Core dumps showing deep recursive call stacks inside rlottie parsing functions
Unexpected termination of UI components or rendering subsystems after opening user-supplied animation assets

Detection Strategies

Inventory applications and container images that ship rlottie and compare embedded commits against e2d19e3b150e0e4a9586fa90b56fd3061cc98945
Add file-type inspection rules that flag Lottie files exceeding reasonable size or nesting thresholds at email and file-share gateways
Correlate process crash telemetry with recent file-open events involving animation assets

Monitoring Recommendations

Collect crash reports from endpoints rendering Lottie animations and forward them to a central log store for analysis
Track software composition analysis (SCA) output for new builds that still reference vulnerable rlottie commits
Alert on processes that repeatedly terminate after parsing untrusted serialized input

How to Mitigate CVE-2026-47306

Immediate Actions Required

Update rlottie to a build that includes commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 or later
Rebuild and redeploy all downstream applications and container images that statically link rlottie
Restrict ingestion of Lottie animation files from untrusted sources until patched builds are deployed

Patch Information

The upstream fix is published in Samsung/rlottie pull request #585. The patch introduces recursion depth and payload size checks during deserialization. Integrators must pull commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945 or any later release into their build pipelines.

Workarounds

Reject Lottie files that exceed a defined byte size or JSON nesting depth before passing them to rlottie
Sandbox the rendering process so a crash in rlottie does not affect the parent application
Disable animation-rendering features that accept user-supplied files where feasible until patches are applied

bash

# Verify the rlottie commit shipped in your build
cd /path/to/rlottie
git log -1 --pretty=format:%H
# Expected output should match or post-date:
# e2d19e3b150e0e4a9586fa90b56fd3061cc98945