Is CVE-2026-110603 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110603?

CVE-2026-110603 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-110603

Description

LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.