Read the docs
TI-2026-76187 Aliases CVE-2026-112059GHSA-jvqw-8644-7mg5

Heap out-of-bounds write in libLAS via LASSchema VLR

Priority MEDIUM 64CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libLAS through 1.8.1 contains a heap out-of-bounds write in its point record reader, caused by truncating the schema byte size to 16 bits (CWE-787). An attacker who supplies a crafted .las file with a LASSchema record over 65535 bytes can corrupt memory when a user processes it with lasinfo, las2las or las2txt, causing crashes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libLASlibLASup to 1.8.1—No fix listedCNA
  • libLAS VendorlibLAS Affected up to 1.8.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libLAS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112059
  2. 2026-10-18 Alias added: GHSA-jvqw-8644-7mg5
  3. 2026-10-19 Priority changed: MEDIUM → LOW
  4. 2026-10-21 Affected versions changed · Red Hat
  5. 2026-10-21 CVSS score added · Red Hat
  6. 2026-10-22 CISA SSVC decision points changed
  7. 2026-10-22 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2024-18287 libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp. CVSS 3.1HIGH 7.5
  • TI-2018-14565 There is memory leak at liblas::Open (liblas/liblas.hpp) in libLAS 1.8.1. CVSS 3.0MEDIUM 6.5
  • TI-2018-14564 There is a Segmentation fault triggered by illegal address access at… CVSS 3.0MEDIUM 6.5
  • TI-2018-14561 There is a heap-based buffer over-read at liblas::SpatialReference::GetGTIF()… CVSS 3.0MEDIUM 6.5
  • TI-2018-14562 There is a NULL pointer dereference at liblas::SpatialReference::GetGTIF()… CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences