CVE catalog

CVE-2026-110603

DEBIAN-CVE-2026-110603

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlaszip133.5.0+really3.5.0-1vulnerable
Debianlaszip133.5.0-2vulnerable
Debianlaszip143.5.0+really3.5.0-1vulnerable
Debianlaszip143.5.0-2vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [liblaszip8]Affected

    Source package: [laszip]

    Details (2)

    • 3.5.0-2+b1 · amd64 · trixie

      Affected

      pypi · laszip · debian · 13

    • 3.5.0-2+b1 · arm64 · trixie

      Affected

      pypi · laszip · debian · 13

  • [liblaszip-api8]Affected

    Source package: [laszip]

    Details (2)

    • 3.5.0-2+b1 · amd64 · trixie

      Affected

      pypi · laszip · debian · 13

    • 3.5.0-2+b1 · arm64 · trixie

      Affected

      pypi · laszip · debian · 13

  • [liblaszip-dev]Affected

    Source package: [laszip]

    Details (2)

    • 3.5.0-2+b1 · amd64 · trixie

      Affected

      pypi · laszip · debian · 13

    • 3.5.0-2+b1 · arm64 · trixie

      Affected

      pypi · laszip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]