CVE-2026-108978: CWE-122 Heap-based buffer overflow in Samsung Opensource rlottie

This vulnerability (CVE-2026-108978) involves a heap-based buffer overflow in the Samsung Opensource rlottie library, triggered by specially crafted environment variables. The issue could lead to an overflow condition on the heap, potentially impacting application stability or availability. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability (no confidentiality or integrity impact). No specific affected versions or patches are identified in the provided information.

The vulnerability can cause a denial of service or crash due to heap corruption, impacting availability. There is no indication of confidentiality or integrity compromise. Exploitation requires local access and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor official Samsung Opensource advisories for updates. Until a fix is available, avoid untrusted environment variable inputs where possible.