Is CVE-2026-95179 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-95179

Description

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.