EUVD-2026-87360Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted LERC imagery to decoder
-
ExploitInteger overflow miscomputes buffer size
-
ExecutionHeap out-of-bounds write during decode
-
ImpactProcess crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application built on Esri LERC 4.1.0 or earlier decodes attacker-controlled LERC-encoded imagery/raster data - i.e., the consuming application must accept and process untrusted LERC input (uploads, tile requests, imagery ingestion). No authentication, privileges, or user interaction are needed (PR:N/UI:N) once such a decode path is reachable. Limiting factors: the library itself is not a network service, so reachability depends entirely on the host application exposing an untrusted-imagery decode path; impact is confined to a crash of that process (availability only), with no confirmed path to code execution or data disclosure. |
| Impact | This is a genuine but bounded-impact vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly captures a remote, unauthenticated, low-complexity flaw with impact restricted entirely to availability - there is no confidentiality or integrity loss, only a crash (denial of service). Although CWE-190 (integer overflow) leading to a heap out-of-bounds WRITE could in principle be a memory-corruption primitive, both Esri's description and the CVSS scoring characterize the realistic outcome as an application crash, not code execution, so the C:N/I:N rating is appropriate and the '7.5' should be read as a DoS-only high, not an RCE-class high. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automated weaponization - no public exploit identified at time of analysis. Real-world priority is moderate: the 'network + unauthenticated + no user interaction' profile is only realized when an application actually feeds attacker-supplied LERC-encoded imagery through the library, so exposure depends heavily on the consuming application's exposure. Treat as a routine-priority patch for services that decode untrusted raster/imagery input, not an emergency. |
| Exploit ScenarioDerived | An attacker uploads or submits a maliciously crafted LERC-encoded raster/image to a web service, tile server, or GIS pipeline that decodes it using LERC 4.1.0 or earlier. During decode, an integer overflow produces an undersized heap allocation followed by an out-of-bounds write, crashing the process and denying service to legitimate users. No public exploit code is identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.
RemediationAI
No vendor-released patch version was identified in the available data, so the first action is to consult the Esri advisory at https://github.com/Esri/lerc/security/advisories/GHSA-cw29-mw7w-pj37 and apply the fixed LERC release it names, or move to a release newer than 4.1.0 as soon as one is published; downstream products embedding LERC must be updated through their own vendors' releases rather than by swapping the library in place. Until an upgrade is possible, compensating controls should focus on removing or hardening the untrusted decode path: reject or quarantine LERC imagery from untrusted sources at the application boundary (side effect: legitimate user-supplied rasters and third-party tile feeds stop working), or, if LERC input must be accepted, pre-validate and cap image dimensions, band counts, and total pixel counts before decoding and enforce hard memory limits on the process so an integer-overflow-induced allocation cannot succeed (side effect: very large but legitimate rasters are rejected). Running the decoder in a separate, low-privilege, memory-capped sandboxed worker with automatic restart and rate limiting contains any crash to a disposable process and preserves the availability of the parent service (side effect: added latency, operational complexity, and potential masking of repeated attack attempts if logging is not monitored); disabling LERC decoding entirely for untrusted imagery is the most reliable interim mitigation but breaks any raster workflow that depends on the format. Because the assessed impact is availability only, prioritize these controls where LERC decoding is reachable by unauthenticated users, and monitor for repeated decode crashes as an indicator of exploitation attempts, noting that no public exploit code was identified at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LERC (Limited Error Raster Compression) is Esri's open-source raster/image format and codec that supports rapid encoding and decoding of any pixel type, and it is typically embedded as a library inside GIS platforms, imagery/tile services, viewers, and data-processing pipelines rather than being exposed directly. The root cause is CWE-190 Integer Overflow: an attacker-controlled field in crafted LERC-encoded imagery (for example dimensions, band/block counts, or pixel/size values) causes a size or offset computation to wrap, so a heap buffer is under-allocated or a bounds calculation is skewed, and the subsequent write lands outside the heap allocation - a heap-based out-of-bounds write. Because decoding is the only requirement, any application that accepts untrusted LERC rasters can be triggered; per the vendor advisory and CVE record, all LERC versions up to and including 4.1.0 are affected. The CPE entry cpe:2.3:a:esri:lerc:*:*:*:*:*:*:*:* carries a wildcard version, so no fixed version is encoded in the CPE data and the affected range must be taken from the advisory text. The assessed vector (PR:N/UI:N, scope unchanged, availability-only) confirms that no authentication or user interaction is needed once a decode path for untrusted imagery exists, and that the demonstrated impact stops at a crash.
Know when Lerc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote crafted imagery reaches the decoder with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a crash only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (Esri).
CVSS VectorVendor: Esri
DescriptionCVE.org
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.
Executive ViewAI
The Esri LERC raster library (versions 4.1.0 and earlier) contains a heap-based out-of-bounds write that allows an unauthenticated, remote attacker to crash applications that decode untrusted LERC imagery, disrupting availability of GIS, mapping, and imagery processing services. Organizations using affected applications-particularly those with exposed imagery upload, tile request, or raster ingestion pipelines-could experience service outages. While no public exploit code has been identified and the issue has not been confirmed as actively exploited (CISA KEV), the lack of authentication requirements and the potential for widespread library use make this a priority for mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to services that decode LERC imagery, disabling LERC decoding for untrusted input, implementing strict input validation and sanitization, deploying a web application firewall to detect and block malformed LERC files, and monitoring for application crashes and anomalous behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB