CVE-2026-112059— libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
Quick assessment
Affected
libLAS libLAS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libLAS 1.8.1 及更早版本中的点记录读取器存在堆越界写入漏洞。该漏洞源于在计算点缓冲区大小时，将 schema 字节大小截断为 16 位。攻击者可构造一个包含 LASSchema 变长记录的 .las 文件，使其 schema 大小超过 65535 字节，从而导致 lasinfo、las2las 或 las2txt 等工具将攻击者控制的字节写入堆缓冲区之外，引发内存损坏和程序崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112059
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
Source: CVE Program / CVE List V5
Vulnerability Description
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-112059
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112059
请登录查看更多情报信息。
Other References for CVE-2026-112059 (2)
IV. Related Vulnerabilities
Same weakness: CWE-787
-
CVE-2026-112060
librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via -
CVE-2026-112018
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_access -
CVE-2026-112012
libtta through 2.3 Stack Out-of-Bounds Write via Zero Channe -
CVE-2026-112007
Schism Tracker through 20260524 Heap Out-of-Bounds Write via -
CVE-2026-111880
FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTL
V. Comments for CVE-2026-112059
No comments yet