CVE-2026-110603: LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
LASzip through 3.5.0 contains an invalid free vulnerability in laszipreadheader() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the LASzip C API are exposed when they open attacker-supplied LAS or LAZ files and subsequently destroy the associated object. The issue requires a crafted file containing truncated variable length record data and an inflated VLR count.
What impact can exploitation have?
Opening and destroying the crafted file can cause the process to crash and can corrupt the heap. The described flaw frees uninitialized heap pointers.
Does exploitation require prior access or user interaction?
The supplied vector indicates no privileges are required, but exploitation has high attack complexity and requires user interaction. An attacker must get a crafted LAS or LAZ file opened by the affected application.
Which versions are affected?
LASzip through version 3.5.0 is affected. The provided references include a commit that may be relevant for obtaining the remediation.