Hi,

The following vulnerability was published for rlottie.

CVE-2026-18772[0]:
| Improper input validation vulnerability in Samsung Open Source
| rlottie allows Oversized Serialized Data Payloads.

https://github.com/Samsung/rlottie/pull/596

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-18772
https://www.cve.org/CVERecord?id=CVE-2026-18772

Please adjust the affected versions in the BTS as needed.

As far as I can see, those merge requests, in particular, limit the maximal
number of processed layers. However, the commits from there do not apply
cleanly due to refactoring in version 0.2 and due to other patches addressing
similar issues. I dare assume that CVE-2026-18772 and CVE-2026-19587 were fixed
by Debian-specific patches, No-cyclic-layers.patch (first appeared in version
0~git20200305.a717479+dfsg-1) and by No-cyclic-structures.patch (from version
0.1+dfsg-4).

https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-layers.patch
https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-structures.patch