CVE-2026-95179
Received Received - Intake

Denial of Service in Lottie-Android via Cyclic Precomposition Reference

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-95179
EUVD
EUVD-2026-102129

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95179 is a denial of service vulnerability in the lottie-android library versions 6.7.1 and earlier. It occurs when a crafted Lottie animation JSON contains cyclic precomposition references, causing uncontrolled recursion in BaseLayer.forModel and CompositionLayer functions. This leads to stack exhaustion and crashes the rendering process.

Detection Guidance

To detect this vulnerability, monitor for crashes or excessive resource usage in Android apps using lottie-android 6.7.1 or earlier when rendering animations. Check logs for stack overflow errors in BaseLayer.forModel or CompositionLayer functions. Validate animations for cyclic precomposition references before rendering.

Impact Analysis

This vulnerability allows a remote attacker to crash any Android app using lottie-android by sending a malicious animation. The attack requires no special privileges and can disrupt app functionality by causing a denial of service through stack exhaustion.

Mitigation Strategies

Avoid rendering untrusted Lottie animations. If rendering is necessary, validate JSON files to ensure no cyclic precomposition references exist. Consider temporarily disabling Lottie rendering in apps until a patch is released. Monitor for updates to lottie-android for an official fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart