{"id":"CVE-2026-112059","published":"2026-10-18T13:16:38.300","lastModified":"2026-10-18T13:16:38.300","description":"libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cpp","tags":[]},{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/header.cpp","tags":[]},{"url":"https://hackmd.io/@haindpwn/liblas-record-length-truncation-heap-overflow","tags":[]},{"url":"https://www.vulncheck.com/advisories/liblas-through-1.8.1-heap-out-of-bounds-write-via-lasschema-vlr","tags":[]}],"exploitRefs":[{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cpp","tags":[]},{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/header.cpp","tags":[]}],"hasPoc":true,"ai":null}