CVE-2026-19518

The CVSS 6.5 rating likely understates the real-world risk because this quantity validation flaw in rlottie's JSON parser is a structural weakness in how Lottie animations process untrusted input at scale, not merely a localized parsing edge case. Lottie animations are vector graphics rendered from JSON payloads that frequently travel through insecure channels — embedded in ads, downloaded from the web, shared via messaging apps. A quantity validation flaw in this pipeline means an attacker doesn't need to discover a memory corruption primitive; they need only craft a malformed animation with an exaggerated count field that overruns the actual array it claims to index. The question isn't whether this can crash a parser in isolation, but whether downstream consumers of rlottie treat parsed animation data as trustworthy after it returns from the library. Many UI frameworks use rlottie to render animations asynchronously, meaning the parsed data may feed directly into rendering loops without re-validation. The CVSS treats this as a single-library issue, but the exposure chain matters: if rlottie is linked into a process with elevated privileges, a parsing vulnerability becomes a privilege escalation vector. The deeper problem is that rlottie's API design creates an ergonomic trap — the library accepts out-of-bounds quantity fields silently rather than returning an explicit error, making its output indistinguishable from valid data under time pressure. This violates the principle of least surprise that developers rely on, and it shifts the validation burden onto every consumer instead of handling it at the library boundary. This pattern has appeared repeatedly in JSON parsers across the industry, suggesting the fix addresses an instance rather than hardening the class. Defenders should examine whether their rlottie implementations perform additional sanitization on parsed quantities before using them in loops or memory allocations — that gap between 'library accepts it' and 'application trusts it' is where real exploits live. Pay particular attention to rlottie embedded in long-running processes, ad networks, messaging platforms, and content management systems that consume untrusted animation payloads. The exposure is compounded in devices that have moved into maintenance mode where nobody is auditing the JSON parser because the animation feature "works."

Reviewed through automated stages and approved by a human before publication.