CVE-2026-110603— LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
Quick assessment
Affected
rapidlasso LASzip
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LASzip 3.5.0 及更早版本中存在一个无效释放漏洞，位于 函数中。攻击者可以通过构造截断的变长记录（VLR）数据，利用未初始化的堆指针执行非法释放操作。当攻击者提供一个包含夸大 VLR 计数的恶意构造的 LAS/LAZ 文件，并通过 C API 打开并最终销毁该文件时，会导致程序崩溃并破坏堆内存结构。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| rapidlasso | LASzip | ≤ 3.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110603
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
Source: CVE Program / CVE List V5
Vulnerability Description
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用未经初始化的指针
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rapidlasso | LASzip | 0 ~ 3.5.0 | - |
|
II. Public POCs for CVE-2026-110603
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110603
请登录查看更多情报信息。
Other References for CVE-2026-110603 (2)
IV. Related Vulnerabilities
Same weakness: CWE-824
-
CVE-2026-86847
Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto -
CVE-2026-110602
libmspack through 0.11alpha Uninitialized Pointer Free via k -
CVE-2026-66081
Apache Thrift: c_glib read_message_begin leaves output param -
CVE-2026-47528
NVIDIA驱动固件未初始化指针漏洞致代码执行 -
CVE-2026-67281
Unauthenticated file read in Mikrotik RouterOS
V. Comments for CVE-2026-110603
No comments yet