Live › vulnerability › CVE-2026-112059
Go to dashboardlibLAS through 1.8.1 truncates the schema size to 16 bits when sizing the point buffer, so a crafted .las file with an oversized LASSchema record causes a heap out-of-bounds write. An attacker who supplies such a file can corrupt memory and crash tools like lasinfo, las2las or las2txt, and may be able to run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run libLAS command-line tools or link the library to read LAS point cloud files, especially where files arrive from outside the organisation. Systems that never open LAS files from untrusted sources are much less exposed. The sources do not say which downstream packages bundle libLAS.
No product ranges from the sources yet.
lasinfo --version or check the installed libLAS package version and compare it with 1.8.1lasinfo, las2las or las2txt binaries are installed on hosts that process untrusted LAS files1.8.1 once a patched release is available; unknown whether one exists yetEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-112059")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.