Laszip
Monthly
Crafted LAS/LAZ point-cloud files parsed by LASzip through 3.5.0 can trigger an invalid free inside laszip_read_header(), crashing the host application and corrupting its heap. A file whose header declares an inflated variable-length-record (VLR) count while supplying truncated VLR data leaves internal attribute pointers uninitialized, so they are freed when the reader is destroyed through the C API (CWE-824, access of uninitialized pointer). The issue is Medium severity (source-provided CVSS 4.0 base 5.8; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), meaning a victim or automated pipeline must open an attacker-supplied file - there is no network-reachable or auto-triggered path - and impact observed is crash plus heap corruption rather than confirmed code execution; no public exploit identified at time of analysis, although a public technical writeup of the bug exists.
Crafted LAS/LAZ point-cloud files parsed by LASzip through 3.5.0 can trigger an invalid free inside laszip_read_header(), crashing the host application and corrupting its heap. A file whose header declares an inflated variable-length-record (VLR) count while supplying truncated VLR data leaves internal attribute pointers uninitialized, so they are freed when the reader is destroyed through the C API (CWE-824, access of uninitialized pointer). The issue is Medium severity (source-provided CVSS 4.0 base 5.8; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), meaning a victim or automated pipeline must open an attacker-supplied file - there is no network-reachable or auto-triggered path - and impact observed is crash plus heap corruption rather than confirmed code execution; no public exploit identified at time of analysis, although a public technical writeup of the bug exists.