Heap Out-of-Bounds Write Vulnerability in libLAS Software by libLAS

CVE-2026-112059

What is CVE-2026-112059?

libLAS up to version 1.8.1 is affected by a heap out-of-bounds write vulnerability that arises during the processing of the LASSchema variable length record. The vulnerability is due to the truncation of the schema byte size, which is limited to 16 bits, leading to potential exploitation. Attackers can create malicious .las files with a schema size exceeding 65535 bytes, resulting in the writing of controlled data beyond the allocated buffer. Such actions can cause memory corruption and unexpected crashes in applications that utilize libLAS, such as lasinfo, las2las, or las2txt. It is crucial for users of libLAS to be aware of this vulnerability to protect their systems from exploitation.

References