CVE-2026-19588

CVE-2026-19588 is an integer overflow in rlottie's dimension parsing that leads to heap corruption. The vulnerability lives in how the library reads width, height, frame count, and layer size fields from untrusted Lottie animation files (both JSON and binary formats), then performs arithmetic on those values without overflow checking before allocating buffers or calculating write offsets. A malicious .json file with crafted dimension values can trigger the overflow, resulting in a buffer under-allocate and subsequent out-of-bounds write on the heap. The exploitation path requires user interaction — the victim must open or load a specially crafted animation file. This could occur through a malicious app, a compromised web page loading a Lottie via JavaScript, or a file opened from external storage. Passive triggers (e.g., thumbnail generation without user consent) are unlikely given how rlottie is typically invoked. The CVSS 6.5 and EPSS 0.00202 correctly position this as a low-probability, high-impact bug in the current threat landscape. What matters more than the vulnerability itself is rlottie's deployment footprint. This library is a transitive dependency that has spread far beyond Samsung's Tizen OS, where it originated. It ships in Qt's lottie-qt module, numerous Android applications via AAR, and embedded firmware images in smart TVs and IoT devices. The key problem: downstream consumers often don't know they're shipping rlottie, and even if they do, they have no path to receive coordinated updates. When the patch lands in Samsung's upstream, it doesn't propagate through standard dependency managers — it sits in a repo that vendor firmware branches may never sync. For defenders, the priority actions are: first, identify whether your build artifacts contain rlottie (check AAR dependencies, firmware SBOMs, Qt module imports); second, understand that this is the third integer-overflow vulnerability in rlottie's parsing layer in five years — the pattern is structural, not coincidental; third, treat any rlottie integration as a high-priority attack surface requiring immediate patching and ongoing monitoring. If you cannot update rlottie directly (common in embedded firmware), consider whether animation parsing can be sandboxed or moved out of the critical trust path. The broader lesson: vector animation libraries are a chronic source of this vulnerability class precisely because they parse complex binary formats with arithmetic that is easy to get wrong under time pressure. Assume this pattern will recur.

Reviewed through automated stages and approved by a human before publication.