CVE-2026-10758— Esri Lerc has a security vulnerability
Quick assessment
Affected
Esri Lerc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Esri LERC 是一种开源的图像或栅格格式，支持对任意像素类型进行快速的编码和解码。在 LERC 版本 4.1.0 及更早版本中，存在一个基于堆的越界写入漏洞，该漏洞由整数溢出引起。远程未认证的攻击者可通过向使用 LERC 的应用程序传递特定构造的、受攻击者控制的图像数据，导致应用程序崩溃，从而引发拒绝服务（DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10758
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Esri Lerc has a security vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-10758
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10758
请登录查看更多情报信息。
Other References for CVE-2026-10758 (1)
IV. Related Vulnerabilities
Same vendor: Esri
-
CVE-2026-69233
stored cross site scripting issue in Esri Portal for ArcGIS -
CVE-2026-69234
reflected cross site scripting vulnerability in Esri Portal -
CVE-2026-69235
stored cross site scripting issue in Esri Portal for ArcGIS -
CVE-2026-69236
stored cross site scripting issue in Esri Portal for ArcGIS -
CVE-2026-69237
HTML injection vulnerability in Esri Portal for ArcGIS
Same weakness: CWE-190
-
CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing -
CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry -
CVE-2026-100208
Microsoft Office Outlook Remote Code Execution Vulnerability -
CVE-2026-96749
Heap out-of-bounds write via signed size overflow in BSON do -
CVE-2026-93577
Integer Overflow or Wraparound in GitLab
V. Comments for CVE-2026-10758
No comments yet