CVE-2026-112059 libLAS CVE debrief

Who should care

Defenders responsible for LAS file processing workflows, vulnerability management, and incident response should assess exposure and prioritize verification and mitigation efforts. This includes operators of LAS file processing tools, vulnerability management teams, and security teams responsible for ensuring the security of LAS file processing workflows.

Why it matters

CVE-2026-112059 is a heap out-of-bounds write vulnerability in libLAS that can cause memory corruption and crashes, requiring defenders to assess exposure, verify and update libLAS, and implement compensating controls.

• Memory corruption and crashes in LAS file processing tools
• Potential for malicious file uploads and exploitation
• Need for verification and updating of libLAS to a secure version
• Importance of compensating controls to detect and prevent malicious activity

Technical summary

The vulnerability is caused by truncating the schema byte size to 16 bits when sizing the point buffer, allowing attackers to craft malicious .las files that can cause memory corruption and crashes in tools like lasinfo, las2las, or las2txt. This can be triggered by a specially crafted .las file with a LASSchema variable length record whose schema exceeds 65535 bytes. The vulnerability affects libLAS through version 1.8.1 and requires defenders to assess exposure and prioritize verification and mitigation efforts. The vulnerability can be exploited through malicious .las files, and defenders should verify and update libLAS to a secure version.

Defensive priority

Defenders should prioritize verifying and updating libLAS to a secure version, assessing exposure in LAS file processing workflows, and implementing compensating controls to detect and prevent malicious file uploads.

Recommended defensive actions

• Verify and update libLAS to a secure version
• Assess exposure in LAS file processing workflows
• Implement compensating controls to detect and prevent malicious file uploads
• Monitor for suspicious LAS file activity
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification from official sources. The vulnerability affects libLAS through version 1.8.1 and can be exploited through malicious .las files. Defenders should verify and update libLAS to a secure version and assess exposure in LAS file processing workflows.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.