{"id":"CVE-2026-112059","kind":"vulnerability","aliases":["CVE-2026-112059"],"related":[],"title":"libLAS: heap overflow in point reader lets crafted LAS files corrupt memory","description":"libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.","summary":"libLAS through 1.8.1 truncates the schema size to 16 bits when sizing the point buffer, so a crafted .las file with an oversized LASSchema record causes a heap out-of-bounds write. An attacker who supplies such a file can corrupt memory and crash tools like lasinfo, las2las or las2txt, and may be able to run code.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geospatial","libas","lidar","package","point-cloud","self-hosted"],"not_affected_if":["liblas-not-installed","no-untrusted-las-files"],"how_to_check":"- Run `lasinfo --version` or check the installed libLAS package version and compare it with `1.8.1`\n- Check whether the `lasinfo`, `las2las` or `las2txt` binaries are installed on hosts that process untrusted LAS files\n- unknown whether the sources list a patched version","fix":"- Move libLAS past `1.8.1` once a patched release is available; unknown whether one exists yet\n- Until then, do not process LAS files from untrusted sources with lasinfo, las2las or las2txt\n- unknown whether the sources give a workaround beyond that","status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:40:57+00:00","updated_at":"2026-10-25T03:40:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move libLAS past `1.8.1` once a patched release is available; unknown whether one exists yet\n- Until then, do not process LAS files from untrusted sources with lasinfo, las2las or las2txt\n- unknown whether the sources give a workaround beyond that","reach":"local","title":"libLAS: heap overflow in point reader lets crafted LAS files corrupt memory","impact":"high","summary":"libLAS through 1.8.1 truncates the schema size to 16 bits when sizing the point buffer, so a crafted .las file with an oversized LASSchema record causes a heap out-of-bounds write. An attacker who supplies such a file can corrupt memory and crash tools like lasinfo, las2las or las2txt, and may be able to run code.","category":"package","nicknames":[],"who_cares":["libas","point-cloud","geospatial","lidar","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker-controlled bytes written past heap buffer; possible code execution","analyst_note":"Confirm the patched version and any vendor advisory or fix commit for libLAS beyond the NVD entry (nvd.nist.gov/vuln/detail/CVE-2026-112059).","how_to_check":"- Run `lasinfo --version` or check the installed libLAS package version and compare it with `1.8.1`\n- Check whether the `lasinfo`, `las2las` or `las2txt` binaries are installed on hosts that process untrusted LAS files\n- unknown whether the sources list a patched version","needs_analyst":true,"not_affected_if":["no-untrusted-las-files","libLAS-not-installed"],"who_is_affected":"Teams that run libLAS command-line tools or link the library to read LAS point cloud files, especially where files arrive from outside the organisation. Systems that never open LAS files from untrusted sources are much less exposed. The sources do not say which downstream packages bundle libLAS.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":3372,"output_tokens":709,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112059':15A,18A '-2026':14A,17A '1.8.1':31B,89C '16':37B,112C '65535':134C 'abl':83B 'attack':63B,119C,145C 'attacker-control':144C 'bit':38B,113C 'bound':60B,96C 'buffer':43B,118C,151C 'byte':109C,135C,147C 'caus':54B,104C,152C 'cloud':25B 'code':86B 'contain':90C 'control':146C 'corrupt':11A,70B,154C 'craft':8A,46B,121C 'crash':73B,156C 'cve':13A,16A 'exceed':133C 'file':10A,48B,68B,124C 'geospati':19B 'heap':2A,56B,92C,150C 'host':28B 'las':9A,47B,123C 'las2las':77B,140C 'las2txt':79B,142C 'lasinfo':76B,139C 'lasschema':52B,127C 'length':129C 'let':7A 'liba':20B 'libla':1A,29B,87C 'lidar':21B 'like':75B,138C 'may':81B 'memori':12A,71B,153C 'out-of-bound':57B,93C 'overflow':3A 'overs':51B 'packag':22B 'past':148C 'point':5A,24B,42B,101C,117C 'point-cloud':23B 'reader':6A,103C 'record':53B,102C,130C 'run':85B 'schema':34B,108C,132C 'self':27B 'self-host':26B 'size':35B,40B,110C,115C 'suppli':65B 'tool':74B,137C 'truncat':32B,106C 'variabl':128C 'vulner':98C 'whose':131C 'write':61B,97C,143C","nicknames":[],"mitigations":[],"who_affected":"Teams that run libLAS command-line tools or link the library to read LAS point cloud files, especially where files arrive from outside the organisation. Systems that never open LAS files from untrusted sources are much less exposed. The sources do not say which downstream packages bundle libLAS.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112059","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}