CVE-2026-110603 rapidlasso CVE debrief

Who should care

Defenders responsible for systems that process LAS/LAZ files using LASzip should assess exposure and prioritize verification and updates to prevent potential crashes and data corruption.

Why it matters

Defenders should prioritize verifying and updating LASzip installations to prevent potential crashes and heap corruption when processing LAS/LAZ files.

• Potential process crashes and heap corruption
• Verification of LASzip version and file processing security
• Restrict access to untrusted LAS/LAZ files
• Monitoring for suspicious file processing activity

Technical summary

The LASzip library through version 3.5.0 is vulnerable to an invalid free in the laszip_read_header() function. This occurs when the function attempts to free uninitialized heap pointers due to truncated variable length record (VLR) data in a LAS/LAZ file. An attacker can exploit this by providing a crafted file with an inflated VLR count, leading to a crash and potential heap corruption when processed and destroyed through the C API.

Defensive priority

Defenders should prioritize verifying and updating LASzip installations to prevent potential crashes and heap corruption.

Recommended defensive actions

• Verify and update LASzip installations to version 3.5.1 or later
• Restrict access to untrusted LAS/LAZ files
• Monitor for suspicious file processing activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an invalid free in laszip_read_header() due to truncated variable length record data. This can be triggered by a crafted LAS/LAZ file with an inflated VLR count. The vulnerability allows attackers to free uninitialized heap pointers, leading to a crash and potential heap corruption. Defenders should verify and update LASzip installations to prevent potential crashes and heap corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.