CVE-2026-112059 Details

A heap out-of-bounds write vulnerability has been identified in libLAS versions through 1.8.1. This vulnerability arises in the point record reader, where the schema byte size is truncated to 16 bits, leading to a mismatch when sizing the point buffer. Attackers can exploit this by crafting a .las file with a LASSchema variable length record that exceeds 65535 bytes. When such a file is processed, tools like lasinfo, las2las, or las2txt can inadvertently write attacker-controlled bytes beyond the allocated heap buffer, causing memory corruption and crashes.

To address this vulnerability, libLAS should implement checks to ensure that the schema byte size does not exceed the 16-bit record-length limit before processing. This can be done by capping dimension sizes in the VLR schema and adding a regression test for this specific scenario.