CVE-2026-112059
libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS libLAS
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.
Text from CVE List
Affected versions 1
- libLASaffected: all versions through 1.8.1CVE List
References 5
- hackmd.io/@haindpwn/liblas-record-length-truncation-heap-overflowAdvisoryvia CVE List
- vulncheck.com/advisories/liblas-through-1.8.1-heap-out-of-bounds-write-via-lasschema-vlrAdvisoryvia CVE List
- hackmd.io/@haindpwn/cve-2026-112059-liblas-record-length-truncation-heap-overflowExploitvia CVE List
- github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cppReferencevia CVE List
- github.com/libLAS/libLAS/blob/1.8.1/src/header.cppReferencevia CVE List