{"id":"CVE-2026-112059","title":"libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR","summary":"libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variabl…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"libLAS","product":"libLAS","affected":["libLAS <= 1.8.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T12:19:49.627Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112059","references":[{"url":"https://hackmd.io/@haindpwn/liblas-record-length-truncation-heap-overflow"},{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cpp"},{"url":"https://github.com/libLAS/libLAS/blob/1.8.1/src/header.cpp"},{"url":"https://www.vulncheck.com/advisories/liblas-through-1.8.1-heap-out-of-bounds-write-via-lasschema-vlr","label":"VulnCheck Advisory: libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T12:41:54.060Z","slug":"CVE-2026-112059","body":"## Overview\n\nlibLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.\n\n## Affected\n\n- `libLAS <= 1.8.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}