NIXPKGS-2026-1876

GitHub issue published 6 hours ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

Permalink CVE-2026-10305

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

Created suggestion 11 hours ago
@LeSuisse ignored package libsForQt5.rlottie-qml 7 hours ago
@LeSuisse accepted 7 hours ago
@LeSuisse published on GitHub 6 hours ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

References

https://github.com/Samsung/rlottie/pull/587

Affected products

rlottie

==223a2a41ba4f462e4abe767bebba49a366c9b9fd

Matching in nixpkgs

pkgs.rlottie

Platform independent standalone c++ library for rendering vector based animations and art in realtime

nixos-unstable 0.2-unstable-2025-10-01
- nixpkgs-unstable 0.2-unstable-2025-10-01
- nixos-unstable-small 0.2-unstable-2025-10-01
nixos-26.05 0.2-unstable-2025-10-01
- nixos-26.05-small 0.2-unstable-2025-10-01
- nixpkgs-26.05-darwin 0.2-unstable-2025-10-01

Ignored packages (1)

pkgs.libsForQt5.rlottie-qml

Library for using rlottie via QML

nixos-unstable 0-unstable-2021-05-03
- nixpkgs-unstable 0-unstable-2021-05-03
- nixos-unstable-small 0-unstable-2021-05-03
nixos-26.05 0-unstable-2021-05-03
- nixos-26.05-small 0-unstable-2021-05-03
- nixpkgs-26.05-darwin 0-unstable-2021-05-03

Package maintainers

@CRTified Carl Richard Theodor Schneider <carl.schneider+nixos@rub.de>