CVE-2026-95179
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-674
Impact
Remote attackers can crash your Android application by serving a maliciously crafted Lottie animation file. They only need to get the app to parse or render an untrusted animation JSON.
Root cause
Uncontrolled recursion in BaseLayer.forModel and CompositionLayer occurs when parsing animation files with cyclic precomposition references, leading to a stack overflow.
Affected systems
lottie-android version 6.7.1 and earlier, including master branch.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
No fixed release is currently specified; check the upstream repository for patches and avoid rendering untrusted or remote Lottie JSON files in the interim.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.