CVE-2025-53075 is a critical improper input validation flaw (CVSS 9.8) in Samsung Open Source rLottie, the Lottie animation renderer. The record describes it as allowing path traversal and lists V0.2 as affected. Samsung merged fixes in pull request 571 in June 2025, so update to a revision that includes them.
What's affected
The record says improper input validation in Samsung Open Source rLottie allows path traversal, and that it affects rLottie V0.2. The weakness is listed as CWE-20. The only reference is pull request 571, the same change that is listed for CVE-2025-53074.
That pull request was merged on June 11, 2025. Its description says it adds validation checks to address potential vulnerabilities in case of a malicious Lottie file, and it lists a type check before a cast, bounds checking in gradient handling, a check for an empty frames vector and rejection of outliers. The pull request page does not say which of those checks maps to which CVE, and I will not guess.
No fixed release number is named in the record, so check which tag or commit of the repository includes the merge.
How to check if you're exposed
rLottie is usually included in other software, so start with what you build. Search your repositories and dependency manifests for rlottie, and check Android, Linux and embedded projects that render Lottie animations.
If you vendor the source, compare it with the upstream fixes. In a clone of the Samsung rlottie repository you can test whether a given fix is in your history:
git merge-base --is-ancestor 36ddb42 HEAD && echo "has PR 573 fix"
That hash is the merge commit for pull request 573. Pull request 571 was merged on the same day, so check the history around June 11, 2025. If your copy is a tarball or a package, look at the package changelog for these fixes.
Then look at where animation files come from. If your application only plays files that you ship, the risk is low. If it renders files from users or the network, the risk is higher.
What to do now
- Find every product and image that includes rLottie, including vendored copies and transitive dependencies.
- Update to a revision of Samsung rlottie that contains the fixes from pull requests 571 and 573, merged on June 11, 2025.
- Where you cannot update, stop rendering animation files from untrusted sources, such as user uploads or third party content.
- Run animation parsing in a sandboxed or low privilege process where possible.
- Re-scan your builds after the update and confirm that the old source is gone.
Why it matters
Input validation is the first line of defence for any parser. A Lottie file is structured data, and if the library trusts its fields without checking type, range or length, a crafted file can drive the library into states the authors did not plan for. The record gives this one a 9.8 with a network vector and no privileges, which reflects a file that arrives from anywhere.
Path traversal is the label the record uses, and the weakness class is the general one, improper input validation. Because the public description is short, rely on the vendor fix and not on guesses about the exact behaviour. The CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing in the record points to attacks in the wild. If your product renders animation files from users, make that part of the system run with as few rights as it can.
Quick check
Is there a release version I can pin to?
The record and references only name V0.2 as affected and point to merged pull requests. Check the Samsung rlottie repository for a tagged release that includes them.
Sources
Last reviewed: 18 October 2026.
