LASzip versions up to 3.5.0 contain an invalid free bug in the function that parses a file header. When a file has a truncated variable‑length record header with an inflated count, the library attempts to free uninitialised heap pointers, causing the process to crash and corrupt the heap. This flaw does not directly give attackers code execution, but can lead to denial of service or subsequent exploitation of the corrupted heap memory.

The vulnerable software is rapidlasso’s LASzip library, versions up to and including 3.5.0. Any application that employs the C API to read LAS/LAZ files will be affected. This includes back‑end services, data processing pipelines, or GIS tools that rely on LASzip to parse point‑cloud files.

The CVSS score of 5.8 classifies this issue as medium severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must supply a crafted LAS/LAZ file containing an inflated VLR count; the file can be introduced locally or through any input channel that the software accepts. The likely attack vector is file‑based via local user or by a remote service that accepts user uploads that are processed without prior validation. While the flaw does not enable code execution on its own, the induced heap corruption creates a window for further exploitation and can disrupt critical services.