CVE-2026-112059: libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that process untrusted .las files with libLAS tools such as lasinfo, las2las, or las2txt are exposed. Exploitation requires a crafted file containing a LASSchema variable length record with a schema larger than 65535 bytes.
Does exploitation require authentication or user interaction?
The vector is local and requires user interaction. No privileges are required, but a user or workflow must cause a vulnerable libLAS tool to read the attacker-crafted .las file.
What is the likely impact of a successful exploit?
The crafted schema causes attacker-controlled bytes to be written past a heap buffer, resulting in memory corruption and crashes. The provided severity vector indicates no confidentiality impact, low integrity impact, and high availability impact.