Descriptionrlottie through 0.2, fixed in commit 2cab35d, contains an unbounded recursion vulnerability that allows attackers to crash the calling process by supplying a crafted Lottie animation file containing a deeply nested precomp asset chain. A chain of approximately 4500 or more precomp assets exhausts the call stack across three cooperating code paths in lottiemodel.cpp and lottieitem.cpp during loadFromFile or renderSync, while a diamond variant additionally causes exponential memory allocation by expanding a shared DAG into a full binary tree, independently exhausting process memory.