CVE-2026-110603: falha de média gravidade em rapidlasso LASzip
LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.2%
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
rapidlasso · LASzipReferências
https://github.com/LASzip/LASzip/blob/3.5.0/src/laszip_dll.cpp#L3967-L3995https://github.com/LASzip/LASzip/blob/3.5.0/src/laszip_dll.cpp#L497-L511https://github.com/LASzip/LASzip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02https://hackmd.io/@haind-pwn/laszip-vlr-uninitialized-freehttps://www.vulncheck.com/advisories/laszip-through-3.5.0-invalid-free-via-truncated-vlr-header-in-laszip-read-header