CVE-2026-112059: libLAS 0 through 1.8.1

Affected technology

libLAS · 0 through 1.8.1
libLAS

Description’s affected range: through 1.8.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as none; integrity impact as low; availability impact as high.