CVE-2026-110603
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable le…
Published Oct 14, 2026 · updated Oct 14, 2026
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
Sources
- CVE.orgCVE-2026-110603
Official CVE identifier
cve.org - NIST NVDCVE-2026-110603
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and de
nvd.nist.gov