---
id: CVE-2026-112059
title: libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
summary: >-
  libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the
  point record reader caused by truncating the schema byte size to 16 bits when
  sizing the point buffer. Attackers can craft a .las file with a LASSchema
  variabl…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: libLAS
product: libLAS
affected:
  - libLAS <= 1.8.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-22T02:19:25.682305Z'
exploitAvailable: true
published: '2026-10-18'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T02:19:48.617Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112059'
references:
  - url: 'https://hackmd.io/@haindpwn/liblas-record-length-truncation-heap-overflow'
  - url: 'https://github.com/libLAS/libLAS/blob/1.8.1/src/detail/reader/reader.cpp'
  - url: 'https://github.com/libLAS/libLAS/blob/1.8.1/src/header.cpp'
  - url: >-
      https://www.vulncheck.com/advisories/liblas-through-1.8.1-heap-out-of-bounds-write-via-lasschema-vlr
    label: >-
      VulnCheck Advisory: libLAS through 1.8.1 Heap Out-of-Bounds Write via
      LASSchema VLR
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112059.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112059'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112059'
tags:
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00182
epssPercentile: 0.07747
ingestedAt: '2026-10-18T12:41:54.060Z'
---

## Overview

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.

## Affected

- `libLAS <= 1.8.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112059.json)