The laspy library contains a flaw in lasreader.py that permits an attacker to manipulate an input LAS file, causing the program to allocate an uncontrolled amount of memory when parsing the file. This uncontrolled memory allocation can lead to a denial of service or exhaustion of system resources, compromising application availability. The weakness is classified as CWE-400 and CWE-789.

The issue applies to the laspy 2.x package, specifically any version up to and including 2.7.0. It affects the LAS File Handler component used to read LAS point cloud data. Systems running an affected version of laspy in a Python environment are potentially vulnerable. The library, distributed on PyPI as laspy, is used in both standalone scripts and larger geospatial processing pipelines.

The CVSS base score of 5.3 indicates a moderate severity, reflecting the requirement for an attacker to provide crafted LAS files and the impact of memory exhaustion on availability. Exploitation is remote, as the vulnerable code is executed when a LAS file is parsed, which can be triggered through any network‑facing service that accepts such files. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time.