libLAS EUVD-2026-103521

Exploitation requires the victim to process an attacker-supplied .las file that contains a LASSchema variable length record whose declared schema exceeds 65535 bytes, using libLAS version 1.8.1 or earlier (or an application that links it) via tools such as lasinfo, las2las, or las2txt. Limiting factors: the attack is LOCAL (AV:L) with no network reachability, and it depends on required user interaction (UI:P) - the malicious file must actually be opened/parsed by a libLAS consumer; no authentication or special privileges are needed (PR:N), and no non-default configuration is required, but the victim must choose to process the untrusted file.

This is a moderate, not urgent, priority. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) scores 6.9 and tells a consistent story: exploitation is LOCAL (the attacker does not reach the target over a network) and requires passive user interaction (UI:P) - a victim must open or process a malicious .las file with a libLAS-linked tool. No EPSS score was provided, there is NO CISA KEV listing, and no confirmed public exploit code was supplied in the references (a detailed technical writeup on hackmd exists, which lowers the research barrier, but that is a vulnerability analysis, not a packaged exploit). The impact is primarily availability (VA:H, i.e. memory corruption/crash) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N); although CWE-787 out-of-bounds writes can sometimes escalate to code execution, the vector's VI:L/VC:N rating indicates the realistic outcome assessed here is a crash rather than reliable arbitrary code execution. Signals are internally consistent - there is no network-vs-local conflict - so the main risk driver is simply whether users process untrusted LiDAR files. Given a local-only vector, required user interaction, a retired niche library, and no evidence of active exploitation, this is a real but low-to-moderate operational risk rather than a drop-everything issue.

An attacker crafts a malicious .las LiDAR file containing a LASSchema variable length record whose declared schema size exceeds 65535 bytes, then delivers it to a victim (e.g., via a shared dataset, download, or data-processing pipeline). When the victim runs a libLAS tool such as lasinfo, las2las, or las2txt against the file, the truncated 16-bit buffer size causes attacker-controlled bytes to be written past the heap buffer, corrupting memory and crashing the tool. No public exploit code was identified in the provided references, though a detailed technical writeup is available.