noon iOS — DotLottiePlayer / vendored libwebp (CVE-2023-4863)

Plants a crafted .lottie into the payment-lottie cache via the react-native-share path-traversal write, then asks you to open the add-card flow to trigger the decode.