CVE-2025-53074: Critical Out-of-Bounds Read in Samsung rLottie

CVE-2025-53074 is a critical out-of-bounds read (CVSS 9.1) in Samsung Open Source rLottie, the library that renders Lottie animations. The record lists V0.2 as affected. Samsung merged validation fixes in pull request 571 in June 2025, so update to a revision that includes them.

What's affected

The record says an out-of-bounds read in Samsung Open Source rLottie allows buffer overflows, and that it affects rLottie V0.2. The weakness is CWE-125. The single reference is pull request 571.

That pull request, titled "Fix security vulnerabilities in Lottie file handling", was merged on June 11, 2025. Its description says it adds validation checks to address potential vulnerabilities in case of a malicious Lottie file. It lists a type check for CompLayer() before casting to model::Layer, bounds checking for Gradient::populate(), a check for an empty frames vector, and rejection of outliers.

The record does not name a fixed release number, so check which tag or commit of the repository includes the merge.

How to check if you're exposed

rLottie is usually included in other software, so start with what you build. Search your repositories and dependency manifests for rlottie, and check Android, Linux and embedded projects that render Lottie animations.

If you vendor the source, compare it with the upstream fixes. In a clone of the Samsung rlottie repository you can test whether a given fix is in your history:

git merge-base --is-ancestor 36ddb42 HEAD && echo "has PR 573 fix"

That hash is the merge commit for pull request 573. Pull request 571 was merged on the same day, so check the history around June 11, 2025. If your copy is a tarball or a package, look at the package changelog for these fixes.

Then look at where animation files come from. If your application only plays files that you ship, the risk is low. If it renders files from users or the network, the risk is higher.

What to do now

1. Find every product and image that includes rLottie, including vendored copies and transitive dependencies.
2. Update to a revision of Samsung rlottie that contains the fixes from pull requests 571 and 573, merged on June 11, 2025.
3. Where you cannot update, stop rendering animation files from untrusted sources, such as user uploads or third party content.
4. Run animation parsing in a sandboxed or low privilege process where possible.
5. Re-scan your builds after the update and confirm that the old source is gone.

Why it matters

An out-of-bounds read means the code reads memory past the end of a buffer. In a library that parses animation files, the input is a file, and a malformed file can steer the parser to indexes that were never checked. The result can be a crash or a leak of nearby memory, and the record scores the impact at high for confidentiality, integrity and availability.

The fix in pull request 571 is a set of input checks, which is the usual remedy for parsers. Lottie files circulate widely through apps and content systems, so the question for you is whether your product accepts files from outside. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record gives no sign of use in attacks.

Quick check

Sources

• Samsung rlottie pull request 571
• Safeguard Gold entry

Last reviewed: 18 October 2026.