The vulnerability is a heap-based buffer overflow in Samsung Opensource rlottie that can be triggered through malicious environment variables. The overflow may corrupt memory, possibly enabling an attacker to execute arbitrary code or crash the application, depending on how the corrupted data is later processed. The weakness is a classic heap buffer overflow (CWE-122).

Affected hosts are those running the Samsung Opensource rlottie library at the specific commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9. No broader version range is listed, so the issue is confined to this particular build until a verified fix replaces it.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits yet. The likely attack vector involves feeding crafted environment variables to a running rlottie process, which is often set by users or applications; if the process runs with sufficient privileges, memory corruption could lead to higher impact. Therefore, the risk is moderate but could be higher if the library runs in privileged contexts.