CVE-2026-10758 Esri CVE debrief

Who should care

Defenders responsible for applications using the LERC library should assess exposure and prioritize verification of LERC versions in use. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability and take necessary actions to protect their systems.

Why it matters

Defenders should care about CVE-2026-10758 because it affects the LERC library used in applications, potentially allowing remote attackers to cause denial of service via crafted imagery inputs. Defenders responsible for applications using LERC should assess exposure, prioritize verification of LERC versions in use, and update to patched versions if necessary.

• Denial of service via application crash
• Potential for data processing disruptions
• Need for verification of LERC library versions
• Possible impact on application availability

Technical summary

A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application. This vulnerability affects the LERC library used in applications, potentially allowing remote attackers to cause denial of service via crafted imagery inputs. The vulnerability is caused by an integer overflow in the LERC library, which can be exploited by a remote attacker.

Defensive priority

Defenders should prioritize verifying LERC library versions and updating to patched versions if necessary.

Recommended defensive actions

• Verify LERC library versions in use
• Update to patched LERC versions if necessary
• Monitor for crafted imagery inputs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the Esri LERC security advisory. The Esri LERC security advisory provides details on the vulnerability, but the CVE record and NVD entry do not offer additional information on affected scope, severity, or vendor guidance. Defenders should verify LERC library versions and review the advisory for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.