CVE-2026-110603
- Source
- https://cve.org/CVERecord?id=CVE-2026-110603
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110603.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-110603
- Downstream
- Published
- 2026-10-14T14:16:44Z
- Modified
- 2026-10-28T11:06:35Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
- Details
-
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-824" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110603.json" }- References
-
- https://github.com
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110603.json
- https://hackmd.io/@haind-pwn/laszip-vlr-uninitialized-free
- https://nvd.nist.gov/vuln/detail/CVE-2026-110603
- https://www.vulncheck.com/advisories/laszip-through-3.5.0-invalid-free-via-truncated-vlr-header-in-laszip-read-header
- https://github.com/LASzip/LASzip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02
- https://github.com/LASzip/LASzip
- https://github.com/LASzip/LASzip/blob/3.5.0/src/laszip_dll.cpp#L3967-L3995
- https://github.com/LASzip/LASzip/blob/3.5.0/src/laszip_dll.cpp#L497-L511
Affected packages
Git / github.com/laszip/laszip
Affected ranges
- Type
- GIT
- Repo
- https://github.com/laszip/laszip
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "last_affected": "3.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "c9bfd3e68d65c84d513a2286ae06cbbe17afda02" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
1.*
1.0.1
1.2.0
2.*
2.0.0
2.0.1
2.0.2
3.*
3.1.0
3.1.1
3.2.0
3.2.1
3.2.2
3.2.8
3.2.9
3.3.0
3.3.1
3.4.0
3.4.1
3.4.3
3.5.0
v2.*
v2.2.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110603.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "114010707062385906044520140251472879642",
"length": 303
},
"id": "CVE-2026-110603-0048be98",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasunzipper.cpp",
"function": "LASunzipper::return_error"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4519421803573292143913285903742575763",
"length": 490
},
"id": "CVE-2026-110603-01d403af",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.cpp",
"function": "LASinterval::has_cells"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"168338204505172050251255560057759014176",
"215354144983072184381529588389848251239",
"299004829577295667957603719169012312751",
"212774276121150435614894188633460706052",
"116756157626650927107812307126042877688",
"165275825395765799937419397567281128274",
"185767838977356738482915165673998968005",
"200555397074898452336577023194323616561",
"50839510965999556793527368020934546959",
"205646305529389228499530151552508386707",
"313571755322767929506042548857383138160",
"220088852218171149684072799534434226959",
"334792826389113318624955822395649801355"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-02a98b74",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "89852954544651735795861485472979751593",
"length": 297
},
"id": "CVE-2026-110603-07cb4c31",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::tiling_setup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230888233966218052311924035416680393167",
"219297946377398103811386320419684851083",
"109514664835859106841327879810662411258",
"105962676614350202603891691996390392482"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-1233f61e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "246090091416137055184811541030681927486",
"length": 1308
},
"id": "CVE-2026-110603-129ad399",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::setup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115429929307456837853783639064984489843",
"length": 6002
},
"id": "CVE-2026-110603-170cdb5f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_POINT14_v3::read_gps_time"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250037116672971922330688411329359497784",
"length": 2352
},
"id": "CVE-2026-110603-18b8a955",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp",
"function": "LASreadPoint::read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152594829093209709913485800685273919870",
"length": 1269
},
"id": "CVE-2026-110603-25c9edd9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_WAVEPACKET14_v4::init"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"294312672814243149215025209357239664197",
"225329889509164701818481731893048469026",
"127331576117978856911399828458276074372",
"2895957055492563912412997716229216792",
"70687052724478825098580200225243210946",
"120313939118284657857809857295300605689",
"184465440087388905474709352691429156719",
"333609635781722007504997361758617549055",
"149835504471190396597232203661315229379",
"227418303516577797179711599615838810625",
"165291151252008051460699060025815271076",
"59405985138290999574767048575266622626",
"57278856967807548920176590460341876426",
"196437122057911205244468477761140619388",
"57271469197174490890392217472468657553",
"192096324676046886389410257166180634051",
"53739828836843796531942180108321628024",
"109154782627211457453486216594360820733",
"54344371821674892998774200343781102986",
"124103075985349817979889285878262265914",
"57369020364161276415491960554122156543",
"57452984279832095935490183333790092091",
"333239515591659753476927365689334067562",
"315145146210682798510344887230139006788",
"123202599637459007595860835043793638016",
"21266693508342441668511299074213802335",
"204692118688090039852582442771225621481"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-298fda77",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasindex.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "279915484578615444495287648296337680580",
"length": 1026
},
"id": "CVE-2026-110603-2d291546",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::manage_cell"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "70351576503634626370814610241230469025",
"length": 125
},
"id": "CVE-2026-110603-2ea69827",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasattributer.hpp",
"function": "get_attribute_size"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "205636832907363909641125150073455092742",
"length": 1373
},
"id": "CVE-2026-110603-3087c9ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp",
"function": "LASreadPoint::seek"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210667895996744467312564866982666025414",
"length": 1679
},
"id": "CVE-2026-110603-3126e00c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_RGBNIR14_v4::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168595720519588178296906040095253778037",
"length": 163
},
"id": "CVE-2026-110603-362753c8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laspoint.hpp",
"function": "has_attribute"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "79974912944201707557887983646311702382",
"length": 2880
},
"id": "CVE-2026-110603-37bf0106",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v2.cpp",
"function": "LASreadItemCompressed_GPSTIME11_v2::read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165345524925822533166750172482780228602",
"length": 126
},
"id": "CVE-2026-110603-3df4a6f9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasattributer.hpp",
"function": "get_attribute_start"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"124567142943551171337405822597826326466",
"47814915642564550892436481762372713690",
"29489810879840091283984704841536349202",
"176759125807410911822636234709854978630",
"157546797632397610791036388506665007120",
"160594933452140475618554241468206409277",
"201638744604100197460199419824433337019",
"200611273993645634335051956672694493904",
"163347907090565276795327322455186469638",
"265938677134802528551352493311520807116",
"43586721347913176623919883400607690664",
"223701334391499968294604103573542800717",
"73930781414471186339536720464589329281",
"176298510282882298677853145092258935469",
"222981842113018445298086962150850787644",
"122501968291210808112190958712592335552",
"321634358611217513027164732409500764236",
"234228515373108990728102756152232708612",
"63708667840452639282313206362382600960",
"200949085630714128870028500419167319505",
"137727825675304139400342883040973934789",
"16021861192478127487054893562223531500",
"231911579564581624059392093855209481899",
"294083938233472291932536759904156959774",
"61008929235451859377677751246229264010",
"140346133137300102836141698356513069972",
"149334834886330983102468055759692247108",
"189717772380170461979997111573931102274",
"20106777197960279288977244884437043297",
"186764436103150226477339922315760811502",
"207084385199697006000931096824418562812",
"28471286778069080523983627259945256034",
"163036873718227759803167935771567018971",
"256903657035979890317724235349868498957",
"271578306455339861662579861678669850499",
"186749714223719809176916871231075999032",
"82749208515630225413195412613775321151",
"222162244104661400704611048330261413425",
"193945555105656936453847297800470789796",
"214803432729363449739980696723517528340",
"105135349804760838859480469610730392589",
"145856401150284999403630589766606859035",
"113260338934124280150796198275897046471",
"185796469076126847404390673615820463634",
"226445019814506179791666521439770690955",
"331705856939663542740057260091807608601",
"288671447576076501031673726330650347809",
"274183188212986760564729753263328742127",
"254279232035470759026751736567942681510",
"176022382365300359765767051009167694810",
"318281301832327257926959678021489945450",
"278499721738068405742407244161166824772",
"55027882962404085013959178559718410989",
"172326131450952050258817050277002334482",
"254044060912024964859447750422092577760"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-428b5a3d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "193334127298199356556120320488667679075",
"length": 133
},
"id": "CVE-2026-110603-4d9b42ee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasattributer.hpp",
"function": "get_attribute_name"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "185272187607649562173019908952763605544",
"length": 2563
},
"id": "CVE-2026-110603-5732e4ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.cpp",
"function": "LASinterval::read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134198395246578319367450675487873977819",
"length": 3823
},
"id": "CVE-2026-110603-63553373",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasindex.cpp",
"function": "LASindex::append"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "198518576664892621168366521084594439432",
"length": 138
},
"id": "CVE-2026-110603-69c9082e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::get_level"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "29243558183539531831748906818170347431",
"length": 1334
},
"id": "CVE-2026-110603-71b775cc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::raster_occupancy"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "185916927053486477699104103765324111854",
"length": 798
},
"id": "CVE-2026-110603-731f6659",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasattributer.hpp",
"function": "init_attributes"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5603824969501616090520167657461897429",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938",
"98094464024996043163564199191164573910",
"154206546489793358299115363577241306216",
"29605648119102188457917230597308457085",
"177663587943455810871225598509252262202",
"25688406525883619525837619253383172781",
"135188376212114556633972953880581277714",
"219497780336202737045865200823738619166",
"164459753036117991484098106169379084805",
"180160483795964250157374043375256241666",
"19590217781945955704381819067209958637",
"302352678165420953942853800407282343964",
"9001648127484579312472595451570499593",
"97817821695206315679820187670276094390",
"238795831249531063745727236839331826703",
"59747262659949610323672059756352680778",
"150918544137095262085161596031842377776",
"292694756510978124597871807459935530450",
"210923463702223014499028789671147035486",
"131494167446503996506147267581368230019",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938",
"37982573802860379879438773750604740725",
"207503717247158673578222663032980473793",
"22890971476654799010619774966824282094",
"153173671235692493511805318109021063197",
"160035032908443749571473559148244619712",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-7697ff71",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"338845066187124818231144973330481398688",
"127846808143918062450221662520378745989",
"222981842113018445298086962150850787644",
"15340347337396162805752932630084423354",
"185079647472007687091470582377234903903",
"276444353319939680180855051948352733340",
"234409498495515839062208439122261040284",
"322163371713164633409413272505069766838",
"52037368844330516887808560950437437208",
"102773042227712380051185624212894701760",
"309940112143785793659424905790526308282"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-7fb072c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laspoint.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41429356962394071385233209510746137292",
"length": 2826
},
"id": "CVE-2026-110603-8ba4b51a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::intersect_circle_with_cells_adaptive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18316370374878806210721057156134599229",
"69742305720749782627504483122656270450",
"87293128586818872517812535358400750538",
"59548252451574850649258823971786635074"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-8dc86285",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszipper.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219539494492178355752310901935111812181",
"length": 1502
},
"id": "CVE-2026-110603-9079d878",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip.cpp",
"function": "LASzip::pack"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333411247799196545019632893071329928736",
"length": 14961
},
"id": "CVE-2026-110603-9117ee3a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip_dll.cpp",
"function": "laszip_write_header"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "184609342430552744712214008180824292759",
"length": 6290
},
"id": "CVE-2026-110603-92001da7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_POINT14_v3::init"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5603824969501616090520167657461897429",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938",
"218128182240437498740557658557819415795",
"107595806690221750860841685760619633289",
"29605648119102188457917230597308457085",
"177663587943455810871225598509252262202",
"25688406525883619525837619253383172781",
"135188376212114556633972953880581277714",
"219497780336202737045865200823738619166",
"164459753036117991484098106169379084805",
"180160483795964250157374043375256241666",
"19590217781945955704381819067209958637",
"302352678165420953942853800407282343964",
"9001648127484579312472595451570499593",
"134083099342825075579717773075723885280",
"214197894434157251428580907061602386548",
"59747262659949610323672059756352680778",
"150918544137095262085161596031842377776",
"292694756510978124597871807459935530450",
"210923463702223014499028789671147035486",
"131494167446503996506147267581368230019",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938",
"37982573802860379879438773750604740725",
"207503717247158673578222663032980473793",
"22890971476654799010619774966824282094",
"153173671235692493511805318109021063197",
"160035032908443749571473559148244619712",
"55148940271307699667843918913087482865",
"62058558834202583015619688139279931577",
"268932670115701217697657550280662835938"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-941b244e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "146385879125155622309002778295108099934",
"length": 1679
},
"id": "CVE-2026-110603-973ef19c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_RGBNIR14_v3::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "289668394457161156192302983296443435208",
"length": 2304
},
"id": "CVE-2026-110603-976c8b5b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::intersect_tile_with_cells_adaptive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"90329367005813614409966204759674026725",
"7737963919525625416588766242977572920",
"21796179566902520135180872101452076471",
"110093084526178678294679781721833307278",
"202437673550627479212777359162476525764",
"103034290634656692584497037613340181609",
"160413125760839664548518258736762504775",
"183247639421573215263738491414127528360",
"116799580691806728233079555135975446644",
"30207030397909993901392105391575623424",
"129540519460048689462321012190364006562",
"101314878133935709754738904841125065057",
"212285569397403974279600330902715496262",
"314599971514798658188032639511328277677",
"91822716506864144296122569419710165600",
"318710137725738169958364914541298641571",
"334303581563794990829145444067659412799",
"192642943132198537894506145291285890122",
"307787494568699214184679692757953759992",
"194621769512677102076734523203897439921",
"157260781968834155037986281667953823322",
"52967411153721181438489235879907213569",
"309019840696352944395507613021522200895"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-9b0d5faf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v2.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287290119774452557353402090004707776900",
"length": 1602
},
"id": "CVE-2026-110603-9d418f4f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laspoint.hpp",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275875146902109052647447849330213607166",
"length": 6290
},
"id": "CVE-2026-110603-a0a86b1a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_POINT14_v4::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "263593511408460765798367593391180399795",
"length": 1989
},
"id": "CVE-2026-110603-a214b5d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39126634932303766659047325298388249301",
"length": 511
},
"id": "CVE-2026-110603-a84dc333",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::subtiling_setup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321211447776071884868671996894738140338",
"length": 860
},
"id": "CVE-2026-110603-ac3753ff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/mydefs.cpp",
"function": "strncpy_las"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9411677735068228272194901823480230488",
"105761843994035565920759596559652009095",
"72055588165243048591482324891832138317",
"37337334712282863489116861368530526067",
"146793825477966127385151943175227739423",
"68251584761770980473810717816452175418",
"15807508472957765418344486416899086842",
"165789813569853292304518409696328721666",
"195691824533340495278713955265202410912",
"69191959645449581147630544019926125880",
"199825506124986364798416643736814917480",
"31375374026605280093529114006717869719",
"270721770950447333220655067823780420671",
"75087809517416952361227265518811858509",
"46117320483549242225477034869576603354",
"313911184164830971764013118598216632932",
"213311075893629073860244356421778660225",
"76654371675865543733775694866663499123",
"243480832183368294258727514581323395501",
"322925040592888976539135316404715968006",
"93208170541895863875202510508074593617",
"160476249248309018320704419857681491052",
"69608108014971220583876004760548207461",
"66077552024365627679622957197794261467",
"121968376669329252457500415951528724249",
"325717308665778200736193765248153498099",
"11362006954700822682123640666393050399",
"177718146756853591203291680538721792000",
"340014322072903875171510478056619356930",
"196724409164557016653440585388983974057",
"169461199531092201058358710127409062651",
"279460386686789328535133355844478561438"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-ad578aad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasattributer.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "302396472520870039008229868163705221365",
"length": 5538
},
"id": "CVE-2026-110603-ade6a73a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp",
"function": "LASreadPoint::setup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "304274911679210190435552106369225766574",
"length": 80
},
"id": "CVE-2026-110603-b3f75d5b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.cpp",
"function": "LASinterval::get_cells"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221074869021669380261797692499511698154",
"length": 1707
},
"id": "CVE-2026-110603-bac7d240",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_BYTE14_v3::init"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"129623137899701601188339606562212023562",
"18510772828719939892800677167460375434",
"188245730329671521651022223103682402518",
"166027871476543149315246382254503707550",
"220925988140623072250175458880424730045",
"217410521750520514874345119408643549221",
"85641316345400773163197839203275407237",
"139020280094067084737352568644087414927",
"14479615818848885575441935252724473412",
"204101764816639847018326147371258309698",
"231456715174580853888258210272210475186",
"67001072548808173058145581230966130504",
"149814506086762722277947959663221490181",
"249120799779346498560699199086363575864",
"125321096762461185706696181798564356508",
"148248461339076206229574819468095981240",
"118817596209181377731452655443331016198",
"163997948470819159207740770773583964587",
"64635222606666987427287937647021104198",
"10480168648904965805962379749393723134",
"250423152833765028305057899042029550466",
"294808046502136941097472480620198011918",
"30045125758651708636892296226233371136",
"207096122616578539118411829723668384856",
"236684040687176353194398139499669472950",
"271038574538552730771884761118341840988",
"30849581591839059334097856697344186908",
"41659481195275677237040325852056237484",
"310939701958183525346470208051304581829",
"100352786731394909111481445797069918365",
"149014402553938647676617628690892286623",
"112864236928742055072593164692355113422",
"77224467065259569586466888196721749798",
"178989651594145012783782523168154619997",
"66394132271074321451366338284719593099",
"62487447663234070173140926859580816801",
"175140201015530884022682345057624094350",
"319063753219409105423450124014328853508",
"289094335517327618543767048701789115019",
"272533939137297927196671576908017910881",
"192314513927229652050231550032412544916",
"98110345678287475556162580967321030345",
"140215795917502864878493066238351588676",
"319063753219409105423450124014328853508",
"289094335517327618543767048701789115019",
"272533939137297927196671576908017910881",
"320410016396954040928846700826434197988",
"112726227527676061374226720222640388632",
"75263570000169862137673758056336131936",
"80694749116895788505316761732944228489",
"34092916128327588414234919673691488440"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-bd9f53bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137708253768987244458085925723865124965",
"length": 4619
},
"id": "CVE-2026-110603-c0d813a4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laswritepoint.cpp",
"function": "LASwritePoint::setup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"99336540693329287265549208770355470044",
"17075071778529688282797163222732000407",
"285208960256854465143023115372355194272",
"13138261853078003325798969933740222445",
"243310161694708314651953736337950528699",
"38359742096429618008165964379441478159",
"265088753118461744156829470193983189199",
"42530533254837952892950665882217059631",
"56516872891652624029859396871886449906",
"92398584018561810484998792792777896475",
"212269771620828571214366079074745848397",
"77675513842852591839481479104640484583",
"165032844460397494228234361530775857042",
"169381919038336310151684975018654538563",
"322258907551501656813406783240677585840",
"166727553069590169883324232391334793474",
"314897727600076783976541580214275069253",
"337547260080321718971727208621918208636",
"230398221885970389569628293548993621385",
"267653645786671041922042716116059063989",
"118701773195864872511467121492652836799",
"263643361878418285946018390928262132163",
"151363437365553812955455484794026196785",
"140883050018813174450800210287315852953",
"311301793176667710175892462699935106548",
"306803818265455032136978281579347344486",
"46264913875797544149124760609187916291",
"244663481300324713077334107703512283224",
"29559335662687381839931000734745803085",
"309129348495358308176062072791710898082",
"255612753116619927351770952159969566382",
"75789143413933727799810857544110951154",
"44430980288608550152233543928073005382",
"71706069580936234870154594722167569427",
"260394572449872211788095499834693208736",
"139782418104487479813724076308599698808",
"114978088399161235087496458045334317728",
"302414853447580484107906955067463643668",
"291259599386976130832727010854966007006",
"80767646548182195323905858257612104999",
"109134359316485969737936371493450549381",
"191402113911133863342674920375086486733",
"89589934772869525535930144639329139004",
"328086695647446389978607701174831210098",
"109134359316485969737936371493450549381",
"191402113911133863342674920375086486733",
"89589934772869525535930144639329139004",
"328086695647446389978607701174831210098",
"109134359316485969737936371493450549381",
"191402113911133863342674920375086486733",
"89589934772869525535930144639329139004",
"328086695647446389978607701174831210098",
"267580127961760250574492857627977202621",
"254398403052652441887207939775264462106",
"237419533941132682298876850701985213395",
"237175386890097647715056749018429267095",
"316672484125140976200422295915225203481",
"192052936960650962678876450896169495117",
"141503222725868311994593602100180323349",
"237175386890097647715056749018429267095",
"91367874650067005653503103882736519840",
"18411997961302724672467447859874965690",
"231015557669892987495864884546209198821",
"217951773192304325780117719572439115498",
"267270974277406418494560738211690645491",
"284099658550543228462171045308850659725",
"191783425386255077066038084546181920344",
"217951773192304325780117719572439115498"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-c1d1d593",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136515411128131529539885626596009518898",
"115515057504184724015284262956336091586",
"72191979656983565788249056622912125272",
"246477557012476265380733952262865653716",
"74986700758379626496595513416435479495",
"223629066834076356476461048705327398693",
"232337391661861934680877265897755852797",
"244749187902582090573877721711489467482"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-c51b63d3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laswritepoint.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"114789893332170043519620861322780083282",
"58122885611602356340483321481531927793",
"177215379404911948646546717615752696622",
"186864290211859749808126388069096488230"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-c7f49e5c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/mydefs.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "293328356822816852105119476809426140509",
"length": 1115
},
"id": "CVE-2026-110603-cb14baef",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_RGB14_v3::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333008448328897156678911681375390054139",
"length": 30442
},
"id": "CVE-2026-110603-cb1c9470",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip_dll.cpp",
"function": "laszip_read_header"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "304326352277918845620633809885326861263",
"length": 7209
},
"id": "CVE-2026-110603-d58f6269",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip_dll.cpp",
"function": "laszip_set_header"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "153587573243625730152616058525542750864",
"length": 1544
},
"id": "CVE-2026-110603-d6d208c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::setup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7382544750796846824181203273447134842",
"length": 1568
},
"id": "CVE-2026-110603-dedfa705",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip.cpp",
"function": "LASzip::unpack"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125531939751315183629604385731460436015",
"268374670439654758986818496721033348803",
"49330558553121876703163577604970127727",
"26065721722876231531277012881562432355",
"333074141710635353878506192750459148821",
"243557827350983617790670397085691919873",
"85503504248870030399914533243567760933",
"127189603505583099406931367017081221737",
"333074141710635353878506192750459148821",
"243557827350983617790670397085691919873",
"85503504248870030399914533243567760933",
"127189603505583099406931367017081221737",
"152411949633187392596850623884096188922",
"29173186846560995026536221342634322459",
"210355022191878079782313937299764456910",
"121219711810738461633777105563691122465",
"269540991963839867724729114060862611215",
"114451142838251525020889626210870165129",
"202197303306279199549952685010250272810"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-e52bccef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszip_dll.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240063386532757113025694196891987618387",
"length": 1707
},
"id": "CVE-2026-110603-e6a5682f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_BYTE14_v4::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "289668394457161156192302983296443435208",
"length": 2304
},
"id": "CVE-2026-110603-ecda4713",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasquadtree.cpp",
"function": "LASquadtree::intersect_rectangle_with_cells_adaptive"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295631093379220978048816218864088056756",
"length": 1269
},
"id": "CVE-2026-110603-ef048bfb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v3.cpp",
"function": "LASreadItemCompressed_WAVEPACKET14_v3::init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "324373566396817805504072364096798620261",
"length": 3730
},
"id": "CVE-2026-110603-eff1dc57",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp",
"function": "LASreadPoint::read_chunk_table"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "171751531607004473887013868267197256283",
"length": 980
},
"id": "CVE-2026-110603-f33f9231",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasindex.cpp",
"function": "LASindex::read"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203995902106912261216519550822838538617",
"length": 6002
},
"id": "CVE-2026-110603-f362ccfd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_POINT14_v4::read_gps_time"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "304890542865849781746209626615436314730",
"length": 264
},
"id": "CVE-2026-110603-f4014d45",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreadpoint.cpp",
"function": "LASreadPoint::init_dec"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222410884887769937168946750867583111740",
"length": 301
},
"id": "CVE-2026-110603-f4f9232b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/laszipper.cpp",
"function": "LASzipper::return_error"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "10893071025887072841798545514425985132",
"length": 314
},
"id": "CVE-2026-110603-faa18649",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasinterval.cpp",
"function": "LASinterval::LASinterval"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304334597157369050127897495125523658505",
"69742305720749782627504483122656270450",
"87293128586818872517812535358400750538",
"59548252451574850649258823971786635074"
],
"threshold": 0.9
},
"id": "CVE-2026-110603-fbd3340e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasunzipper.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "199331208693152538774299248049871313051",
"length": 1115
},
"id": "CVE-2026-110603-fefbfafe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/laszip/laszip/commit/c9bfd3e68d65c84d513a2286ae06cbbe17afda02",
"target": {
"file": "src/lasreaditemcompressed_v4.cpp",
"function": "LASreadItemCompressed_RGB14_v4::init"
}
}
]
vanir_signatures_modified
"2026-10-28T11:06:35Z"