CVE-2026-108978

5.5Medium

Published 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.5Medium

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-122

Impact

A local attacker can crash applications using rlottie by supplying crafted environment variables. This results in a denial of service via a heap-based buffer overflow.

Root cause

A heap-based buffer overflow occurs when parsing input from environment variables.

Affected systems

Samsung rlottie commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fix & remediation

Merge pull request #609 into your rlottie source build. As an interim workaround, sanitize or unset any rlottie-related environment variables passed into applications using the library.

shell

$ git pull && git cherry-pick -m 1 609

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

References

https://github.com/Samsung/rlottie/pull/609/

Source: nvd.nist.gov/vuln/detail/CVE-2026-108978