# CVE-2026-108978: Samsung rlottie heap-based buffer overflow via environment variables

Source: https://junglewise.ai/threats/cve-2026-108978-heap-based-buffer-overflow-vulnerability-in-samsung-opensource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108978 · Severity: medium · CVSS 5.5 · Published 2026-10-11

Samsung rlottie is an open-source animation rendering library used in many applications and embedded systems. A heap-based buffer overflow vulnerability allows an attacker to trigger a crash or potentially execute arbitrary code by supplying malicious input through environment variables, affecting systems that process untrusted animation files.

Technologies: [Samsung Rlottie](https://junglewise.ai/threats/technologies/rlottie). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-108978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108978 being exploited in the wild.

**How severe is CVE-2026-108978?** Medium severity, with a CVSS score of 5.5, published 11 October 2026.

**Which products and versions are affected?** Samsung Rlottie prior to commit 2bca1630e (or PR #609 merge date September 30, 2026).

**Is there a fix for CVE-2026-108978?** Yes: fixed in Samsung rlottie commit 2bca1630e (merged in PR #609, September 30, 2026). Until then: Restrict access to environment variables that control image decoding behavior and avoid processing animation files from untrusted sources until an updated version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108978 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-108978?** Check whether you run Samsung Rlottie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Samsung rlottie commit 2bca1630e (merged in PR #609, September 30, 2026)

Restrict access to environment variables that control image decoding behavior and avoid processing animation files from untrusted sources until an updated version is deployed.

## Technical details

A heap-based buffer overflow exists in Samsung rlottie's image loading component (vimageloader) where allocation failures are not properly handled when VBitmap cannot allocate sufficient memory for image dimensions. The vulnerability can be triggered via environment variables that influence image decoding, allowing an attacker to bypass bounds checks and overflow heap-allocated buffers. The fix involves skipping images when VBitmap allocation fails or reported dimensions are invalid.

## Affected products

- Samsung rlottie prior to commit 2bca1630e (or PR #609 merge date September 30, 2026)

## Timeline

- 2026-10-11: disclosed
- 2026-09-30: patched: Fix merged via PR #609

## References

- [https://github.com/Samsung/rlottie/pull/609/](https://github.com/Samsung/rlottie/pull/609/)

## Related threats

- [Samsung rLottie stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-91826-samsung-rlottie-stack-based-buffer-overflow)
- [Samsung rLottie out-of-bounds read in stb_image](https://junglewise.ai/threats/cve-2026-49509-samsung-rlottie-out-of-bounds-read-in-stb-image)
- [Samsung rlottie uncontrolled recursion in shape group parsing](https://junglewise.ai/threats/cve-2026-82797-samsung-rlottie-uncontrolled-recursion-in-shape-group-parsing)
- [Samsung rlottie integer overflow to buffer overflow](https://junglewise.ai/threats/cve-2026-19588-samsung-rlottie-integer-overflow-to-buffer-overflow)
- [Samsung rlottie uncontrolled resource consumption via repeater budget](https://junglewise.ai/threats/cve-2026-19587-samsung-rlottie-uncontrolled-resource-consumption-via-repeater)