The vulnerability in rlottie is caused by an integer overflow or wraparound condition that allows buffer overflow scenarios. This issue affects multiple specific versions of the rlottie package distributed with Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. The CVSS vector (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates the attack requires local access, high attack complexity, low privileges, and user interaction, with limited confidentiality and integrity impact but high impact on availability. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

Successful exploitation could lead to buffer overflow conditions that may cause denial of service or other availability impacts. Confidentiality and integrity impacts are limited according to the CVSS vector. The vulnerability requires local access and user interaction, with a high attack complexity, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit local access to affected systems and restrict use of the rlottie library where possible. Monitor official Ubuntu security advisories for updates.