---
id: CVE-2026-112059
title: libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
summary: >-
  libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the
  point record reader caused by truncating the schema byte size to 16 bits when
  sizing the point buffer. Attackers can craft a .las file with a LASSchema
  variabl…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: libLAS
product: libLAS
affected:
  - libLAS <= 1.8.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T12:19:49.627Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112059'
references:
  - url: 'https://hackmd.io/@haindpwn/liblas-record-length-truncation-heap-overflow'
  - url: 'https://github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cpp'
  - url: 'https://github.com/libLAS/libLAS/blob/1.8.1/src/header.cpp'
  - url: >-
      https://www.vulncheck.com/advisories/liblas-through-1.8.1-heap-out-of-bounds-write-via-lasschema-vlr
    label: >-
      VulnCheck Advisory: libLAS through 1.8.1 Heap Out-of-Bounds Write via
      LASSchema VLR
tags:
  - cve.org
ingestedAt: '2026-10-18T12:41:54.060Z'
---

## Overview

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.

## Affected

- `libLAS <= 1.8.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.