CVE-2026-95179 in lottie-android
Summary
by MITRE • 10/15/2026
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in lottie-android versions 6.7.1 and earlier, including the master branch, represents a critical flaw within the library's handling of Lottie animation JSON structures. This issue specifically targets the parsing and rendering logic responsible for managing precompositions, which are essentially nested animations that allow developers to reuse complex visual elements across different parts of an application or within a single animation file. The core technical defect lies in the failure to detect cyclic references when constructing the dependency graph of these precomposed layers. When a maliciously crafted JSON payload is provided by a remote attacker, it can define a circular reference chain among multiple precompositions. This structural anomaly bypasses standard validation checks that are typically designed to ensure acyclic dependencies, thereby allowing the rendering engine to proceed with processing an invalid logical structure.
The operational impact of this flaw manifests as uncontrolled recursion within the BaseLayer.forModel and CompositionLayer methods. As the library attempts to resolve the nested precomposition references, it enters a recursive loop because each layer in the cycle points back to another layer that eventually leads back to itself. This infinite recursion rapidly consumes stack space on the device's processor, leading directly to a StackOverflowError or similar runtime exception. Consequently, this results in an immediate denial of service condition where the application utilizing the lottie-android library crashes unexpectedly. For end-users, this means sudden termination of the app without warning data loss potential if state was not saved prior to the crash. For developers and organizations relying on stable UI rendering for critical functions, such instability undermines trust in the component's reliability and can disrupt user workflows significantly.
From a security classification perspective, this vulnerability aligns with CWE-674, which describes Uncontrolled Recursion, as well as CWE-835 regarding Loop with Unreachable Exit Condition. The attack vector is classified under ATT&CK technique T1499, Endpoint Denial of Service, specifically through resource exhaustion via application crash rather than system-level saturation. While the primary impact is availability-related denial of service, it is important to note that in certain complex scenarios involving memory management or subsequent error handling routines, such crashes could potentially be leveraged for further exploitation if other vulnerabilities exist within the same codebase. However, based on current information, the direct consequence remains a stable crash leading to application termination.
Mitigation strategies should focus primarily on updating the lottie-android dependency to version 6.7.2 or later where this cyclic reference detection has been implemented and patched. Developers must ensure that their build pipelines enforce strict version constraints for third-party libraries to prevent regression into vulnerable states during updates. Additionally, input validation at the application level can serve as a secondary defense layer by sanitizing incoming JSON payloads before they are passed to the rendering engine. Implementing timeout mechanisms or recursion depth limits within custom wrappers around lottie-android functions may also provide resilience against similar future vulnerabilities in other libraries that handle recursive data structures. Regular security audits of third-party dependencies and monitoring for new CVEs related to UI component libraries are essential practices for maintaining robust application integrity.