CVE-2025-53076 is a critical improper input validation flaw (CVSS 9.8) in Samsung Open Source rLottie, described as allowing a buffer over-read. The record lists V0.2 as affected. The linked fix is pull request 573 for dotLottie decompression, merged in June 2025, so update to a revision that includes it.
What's affected
The record says improper input validation in Samsung Open Source rLottie allows buffers to be overread, and that it affects rLottie V0.2. The weakness is listed as CWE-20. Its reference is pull request 573.
That pull request is titled "Fix dotLottie file decompression" and was merged on June 11, 2025 as commit 36ddb42. Its description reads "Add checks and fixed resource freeing". dotLottie is the packaged form of Lottie animations, a compressed archive that the library has to unpack before it can render, so the fix concerns the unpacking step.
The record does not name a fixed release number. Check which tag or commit of the repository includes the merge, and note that a separate change, pull request 571, covers related validation work.
How to check if you're exposed
rLottie is usually included in other software, so start with what you build. Search your repositories and dependency manifests for rlottie, and check Android, Linux and embedded projects that render Lottie animations.
If you vendor the source, compare it with the upstream fixes. In a clone of the Samsung rlottie repository you can test whether a given fix is in your history:
git merge-base --is-ancestor 36ddb42 HEAD && echo "has PR 573 fix"
That hash is the merge commit for pull request 573. Pull request 571 was merged on the same day, so check the history around June 11, 2025. If your copy is a tarball or a package, look at the package changelog for these fixes.
Then look at where animation files come from. If your application only plays files that you ship, the risk is low. If it renders files from users or the network, the risk is higher.
What to do now
- Find every product and image that includes rLottie, including vendored copies and transitive dependencies.
- Update to a revision of Samsung rlottie that contains the fixes from pull requests 571 and 573, merged on June 11, 2025.
- Where you cannot update, stop rendering animation files from untrusted sources, such as user uploads or third party content.
- Run animation parsing in a sandboxed or low privilege process where possible.
- Re-scan your builds after the update and confirm that the old source is gone.
Why it matters
Archive handling is a common source of memory bugs. The code reads a length or size from the file, allocates or reads according to it, and trusts the numbers. If a crafted archive lies about its sizes, the reader can run past the end of a buffer. The pull request adds checks and corrects how resources are freed, which are both typical fixes for this class.
An over-read can leak memory that sits next to the buffer or crash the process. The record scores it high on all three impact measures. It is not on the CISA Known Exploited Vulnerabilities list and the record gives no sign of attacks. The takeaway is the same as for any parser that eats files from users: update the library and keep that component in a low privilege process.
Quick check
Is there a release version I can pin to?
The record and references only name V0.2 as affected and point to merged pull requests. Check the Samsung rlottie repository for a tagged release that includes them.
Sources
Last reviewed: 18 October 2026.
