CVE-2026-108978 - Samsung rlottie Heap-based Buffer Overflow

Posted Oct 11, 2026

By ictsec.pl

1 min read

A heap-based buffer overflow vulnerability in Samsung Open-source rlottie allows for a buffer overflow via environment variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9. The vulnerability is rated 5.5 MEDIUM on the CVSS 3.1 scale. 🚨

Details

Published Date: October 11, 2026, 10:16 p.m.
Remotely Exploit: No.
Source: PSIRT@samsung.com

A new CVE was received by PSIRT on October 11, 2026. CVE-2026-108978 is associated with the following CWEs:

CWE-122: Heap-based Buffer Overflow

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which describe the common attributes and approaches employed by adversaries to exploit the weaknesses of CVE-2026-108978. One such pattern is:

CAPEC-92: Forced Integer Overflow

Affected Products

The following products are affected by the CVE-2026-108978 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

Total Affected Vendor: 0
Products: 0

Recommendations

To address this vulnerability, update rlottie to patch the heap-based buffer overflow vulnerability. Apply vendor-provided patches for rlottie and recompile rlottie with updated sources.

For more information, you can read the complete article here: Read full article

SECURITY

This post is licensed under CC BY 4.0 by the author.