CVE-2026-10758 in LERC
Summary
by MITRE • 09/25/2026
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Esri Local Encoding Raster Compression format, commonly referred to as LERC, is designed for efficient storage and transmission of raster data by supporting rapid encoding and decoding across various pixel types. While this efficiency makes it valuable in geospatial applications, the implementation contains a critical memory safety flaw within versions 4.1.0 and earlier that stems from an integer overflow condition during heap allocation processes. This vulnerability arises when the software fails to properly validate arithmetic operations related to buffer sizes before allocating memory on the heap. Specifically, if an attacker provides specially crafted imagery data where calculated dimensions or array lengths exceed valid bounds due to wrap-around behavior in signed integer calculations, the application may allocate a significantly smaller buffer than intended.
When subsequent write operations occur based on the original, unvalidated size expectations rather than the actual allocated memory region, a heap-based out-of-bounds write is triggered. This type of memory corruption allows an attacker to overwrite adjacent memory structures that are critical for program execution flow or data integrity. Although the primary observed impact in many scenarios involves application crashes leading to denial of service conditions where availability is compromised, such low-level memory manipulation inherently carries the risk of arbitrary code execution if the overwritten memory regions can be controlled by a remote actor. The vulnerability affects any system integrating LERC libraries that process untrusted raster inputs without implementing strict input validation or bounds checking prior to processing.
From a classification perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write, which are fundamental categories of memory corruption vulnerabilities often exploited in complex software stacks. In the context of attack vectors, this vulnerability corresponds to ATT&CK technique T1203 Exploitation for Client Execution if leveraged for code execution, though currently documented impacts focus on denial of service via process termination. The risk is particularly acute in environments where LERC data sources are not fully trusted or when automated pipelines ingest imagery from external partners without rigorous sanitization protocols.
Mitigation strategies primarily involve upgrading to patched versions of the Esri LERC library that include proper integer overflow checks and bounds validation before memory allocation occurs. For organizations unable to immediately update their dependencies, implementing input filtering mechanisms at the application layer can help detect malformed raster headers or suspiciously large dimension values before they reach the vulnerable parsing logic. Additionally, deploying runtime protection technologies such as heap hardening features in modern compilers or using address sanitizer tools during development and testing phases can help identify similar memory safety issues early in the software lifecycle. Regular security audits of third-party geospatial libraries are essential to maintain resilience against these types of low-level exploitation attempts that target core data processing functions.