A heap‑based out‑of‑bounds write arises from an integer overflow when decoding image data with Esri LERC. The flaw enables a remote, unauthenticated attacker to supply a maliciously crafted raster file that will cause the application using the LERC library to crash. The primary consequence is denial of service, with no direct data compromise reported.

The vulnerability affects the Esri LERC library, version 4.1.0 and any earlier releases. Any application that embeds this library and accepts external imagery is potentially impacted. The affected vendor is Esri, product LERC.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score is not available, and it is not listed in CISA's KEV catalog, indicating a lower known exploitation footprint. However, because the exploit requires only a crafted image, a malicious actor can supply it over the network if the target application accepts untrusted imagery, making the attack vector remote and straightforward.