MEDIUM
rapidlasso
CVE published 2026-10-14
CVE-2026-110603
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. This vulnerability can be triggered by a crafted LAS/LAZ file with an inflated VLR count, leading to a crash and potential heap corruption when processed and destroyed through the C API. Defenders responsible for systems th [truncated]