The vulnerability arises when the point record reader truncates the LASSchema variable‑length record byte size to 16 bits while allocating a heap buffer. Attackers can craft a LAS file whose schema exceeds 65535 bytes, causing memory corruption as data are written past the allocated buffer. This results in application crashes and, depending on the runtime environment, could enable arbitrary code execution. The flaw is a classic heap out‑of‑bounds write (CWE‑787).

The issue affects the open‑source LibLAS library, specifically all releases up to and including 1.8.1. Users of LibLAS in tools such as lasinfo, las2las, or las2txt that read .las files are impacted.

The CVSS score of 6.9 indicates a medium‑to‑high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the supply of a crafted .las file to a tool that processes LAS data; an attacker could deliver such a file via network, removable media, or local storage to cause crashes or potentially execute code.