CVE-2026-10758: Esri Lerc has a security vulnerability
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Esri LERC version 4.1.0 or earlier are exposed if they accept and process attacker-controlled LERC imagery. The vulnerable component is an open-source image or raster encoding and decoding library.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to provide specially crafted imagery to an application that uses LERC. No authentication or user interaction is required, and the issue is remotely exploitable.
What is the expected impact of successful exploitation?
Successful exploitation can crash the affected application, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.