CVE-2026-122052

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122052", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T16:02:58.324Z", "datePublished": "2026-11-05T00:15:21.582Z", "dateUpdated": "2026-11-05T20:30:55.743Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T00:15:21.582Z"}, "title": "laspy LAS File lasreader.py memory allocation", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-789", "lang": "en", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}], "affected": [{"vendor": "n/a", "product": "laspy", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1", "status": "affected"}, {"version": "2.2", "status": "affected"}, {"version": "2.3", "status": "affected"}, {"version": "2.4", "status": "affected"}, {"version": "2.5", "status": "affected"}, {"version": "2.6", "status": "affected"}, {"version": "2.7.0", "status": "affected"}], "cpes": ["cpe:2.3:a:laspy:laspy:*:*:*:*:*:*:*:*"], "modules": ["LAS File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T17:08:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Mohammedix88 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/431136", "name": "VDB-431136 | laspy LAS File lasreader.py memory allocation", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/431136/cti", "name": "VDB-431136 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122052", "name": "CVE-2026-122052 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026182", "name": "Submit #1026182 | laspy 2.7.0 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/laspy/laspy/issues/378", "tags": ["issue-tracking"]}, {"url": "https://github.com/laspy/laspy/issues/378#issuecomment-6146934274", "tags": ["issue-tracking"]}, {"url": "https://github.com/laspy/laspy/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:30:44.603576Z", "id": "CVE-2026-122052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:30:55.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:30:44.603576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:30:50.820Z"}}], "cna": {"title": "laspy LAS File lasreader.py memory allocation", "credits": [{"lang": "en", "type": "reporter", "value": "Mohammedix88 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:laspy:laspy:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["LAS File Handler"], "product": "laspy", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7.0"}]}], "timeline": [{"lang": "en", "time": "2026-11-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-04T17:08:03.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431136", "name": "VDB-431136 | laspy LAS File lasreader.py memory allocation", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/431136/cti", "name": "VDB-431136 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122052", "name": "CVE-2026-122052 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026182", "name": "Submit #1026182 | laspy 2.7.0 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/laspy/laspy/issues/378", "tags": ["issue-tracking"]}, {"url": "https://github.com/laspy/laspy/issues/378#issuecomment-6146934274", "tags": ["issue-tracking"]}, {"url": "https://github.com/laspy/laspy/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T00:15:21.582Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122052", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:30:55.743Z", "dateReserved": "2026-11-04T16:02:58.324Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T00:15:21.582Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:laspy:laspy:*:*:*:*:*:*:*:*"], "modules": ["LAS File Handler"], "product": "laspy", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible."}], "id": "CVE-2026-122052", "lastModified": "2026-11-05T21:18:42.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122052", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:30:44.603576Z", "version": "2.0.3"}}]}, "published": "2026-11-05T01:17:21.670", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/laspy/laspy/"}, {"source": "cna@vuldb.com", "url": "https://github.com/laspy/laspy/issues/378"}, {"source": "cna@vuldb.com", "url": "https://github.com/laspy/laspy/issues/378#issuecomment-6146934274"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122052"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1026182"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431136"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431136/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "laspy: laspy: Denial of Service via uncontrolled memory allocation", "id": "2567734", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567734"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.", "A flaw was found in laspy. When parsing a specially crafted LAS file, the file reading component fails to properly restrict memory usage, leading to uncontrolled memory allocation. A remote attacker could exploit this vulnerability by tricking a user or system into processing a malicious file, causing excessive resource consumption and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122052", "public_date": "2026-11-05T00:15:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122052\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122052\nhttps://github.com/laspy/laspy/\nhttps://github.com/laspy/laspy/issues/378\nhttps://github.com/laspy/laspy/issues/378#issuecomment-6146934274\nhttps://vuldb.com/cve/CVE-2026-122052\nhttps://vuldb.com/submit/1026182\nhttps://vuldb.com/vuln/431136\nhttps://vuldb.com/vuln/431136/cti"], "statement": "This vulnerability is rated as having a Low impact because successful exploitation requires user interaction to ingest an untrusted input file, limiting the blast radius to process termination. In typical Red Hat environments, the laspy library is invoked as an unprivileged client utility or Python module rather than a persistent network daemon. Consequently, excessive memory consumption during file handling only degrades the specific parsing task without compromising system integrity or confidentiality.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "original": {"product": "laspy", "source": "cna", "vendor": "n/a"}, "product": "laspy", "vendor": "laspy"}], "created": "2026-11-05T01:45:14.351390+00:00", "updated": "2026-11-06T21:27:18.684943+00:00", "vendors": ["laspy", "laspy$PRODUCT$laspy"]}