CVE-2026-108978
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via...
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
CVE-2026-108978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2026-97125
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
EUVD-2026-97125- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c43m-q6qx-m6m9
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via...
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
GHSA-c43m-q6qx-m6m9- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
CVE-2026-108978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSV
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
CVE-2026-108978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-108978
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
DEBIAN-CVE-2026-108978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-108978
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- Record
UBUNTU-CVE-2026-108978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rlottieDebian:12 |
All versions, plus listed versions 0.1+dfsg-40.1+dfsg-4+deb12u10.1+dfsg-4+deb12u20.1+dfsg-4.10.1+dfsg-4.20.1+dfsg-4.30.1+dfsg-5 |
None known |
rlottieDebian:13 |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.2+deb13u10.1+dfsg-4.2+deb13u20.1+dfsg-4.30.1+dfsg-5 |
None known |
rlottieDebian:14 |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.30.1+dfsg-5 |
None known |
rlottieUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0~git20190721.24346d0+dfsg-20~git20190721.24346d0+dfsg-2build10~git20200305.a717479+dfsg-10~git20200305.a717479+dfsg-1ubuntu0.1~esm10~git20200305.a717479+dfsg-1ubuntu0.1~esm20~git20200305.a717479+dfsg-1ubuntu0.1~esm3 |
None known |
rlottieUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.1+dfsg-20.1+dfsg-2ubuntu0.10.1+dfsg-2ubuntu0.20.1+dfsg-2ubuntu0.2+esm1 |
None known |
rlottieUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.1+dfsg-4ubuntu10.1+dfsg-4ubuntu1.10.1+dfsg-4ubuntu1.1+esm1 |
None known |
rlottieUbuntu:26.10 |
All versions, plus listed versions 0.1+dfsg-4.30.1+dfsg-5 |
None known |
rlottieUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 0.1+dfsg-4.20.1+dfsg-4.30.1+dfsg-4.3ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108978 is a medium vulnerability (CVSS 5.5) in Samsung Open Source Rlottie, published October 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. No source names a fixed version.
References
github.com/Samsung/rlottie/pull/609
nvd.nist.gov/vuln/detail/CVE-2026-108978
security-tracker.debian.org/tracker/CVE-2026-108978
ubuntu.com/security/CVE-2026-108978
cve.org/CVERecord?id=CVE-2026-108978