CVE-2026-122052 · Package
NO FIX YET
laspy, a Python library for reading LAS point-cloud files, has an uncontrolled memory allocation in its file reader up to version 2.7.0. A crafted LAS file can make a program using it allocate excessive memory, which can crash or exhaust the host.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use laspy up to 2.7.0 to read LAS files, especially ones that accept LAS files from outside sources. The sources do not describe a specific configuration; teams that do not parse LAS files from untrusted input can likely skip it.
Not affected if no-untrusted-las-input
Who cares geospatial, laspy, python
pip show laspy and compare the version against 2.7.0laspy in requirements.txt, pyproject.toml or poetry.lockNo fix yet, per the sources.
A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.