libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16… (CVE-2026-112059)

The vulnerability in libLAS through version 1.8.1 (CVE-2026-112059) is a heap out-of-bounds write caused by truncating the schema byte size to 16 bits when allocating the point buffer. An attacker can create a .las file with a LASSchema variable length record whose schema size exceeds 65535 bytes. When processed by affected tools, this leads to writing attacker-controlled data beyond the allocated heap buffer, resulting in memory corruption and potential application crashes. The CVSS 3.1 score is 6.1, indicating a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Successful exploitation causes memory corruption and application crashes in libLAS tools such as lasinfo, las2las, and las2txt. There is no direct confidentiality impact, but integrity is slightly affected and availability is significantly impacted due to crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted .las files with affected libLAS versions to prevent potential crashes and memory corruption.