The vulnerability resides in the lottie-android library, specifically versions up to 6.7.1 and the current master branch. An attacker can supply a specially crafted Lottie animation JSON file that contains a cyclic precomposition reference graph. When the animation is rendered, the library enters uncontrolled recursion in BaseLayer.forModel and CompositionLayer, ultimately leading to a stack overflow or application crash. This flaw is identified as CWE‑674, resulting in denial of service for the affected application and potentially interrupting legitimate user experience.

Impactfully, any Android application that incorporates lottie-android 6.7.1 or earlier, or which builds against the current master, is susceptible. This includes apps developed using the Airbnb lottie-android library. No specific vendor supply chain known; the code belongs to the open‑source project hosted on GitHub.

The CVSS base score of 7.5 reflects a high severity. The EPSS score of less than 1 % indicates a very low probability of execution in the wild at this time, and the vulnerability is not presently listed in the CISA KEV catalog. The attack vector remains remote; a malicious actor simply needs to deliver the crafted JSON animation to any host application that loads animations via lottie‑android. Because the flaw manifests during normal rendering, the exploitation condition is straightforward: the app must load the vulnerable animation file.