| Title | laspy 2.7.0 Uncontrolled Memory Allocation |
|---|
| Description | laspy up to 2.7.0 is affected by uncontrolled memory allocation leading to denial of service. When reading a LAS file, the reader takes the point count field directly from the attacker-controlled LAS header and allocates a buffer sized point_count multiplied by the point size (laspy/lasreader.py around line 335) before validating that value against the actual file size. A tiny crafted file can therefore declare an enormous point count and force a huge allocation. Runtime verified against the latest release: a 227-byte crafted file drives an allocation request of about 85 GB, with measured real RSS of 614 MB before failure, which is enough to crash or hang any service that parses untrusted LAS input. CWE-789. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5. Suggested fix: validate the declared point count against the remaining file size before allocating. |
|---|
| Source | ⚠️ https://github.com/laspy/laspy/issues/378 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 20:24 (23 days ago) |
|---|
| Moderation | 11/04/2026 17:03 (23 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431136 [laspy up to 2.7.0 LAS File laspy/lasreader.py memory allocation] |
|---|
| Points | 20 |
|---|