CVE-2026-10758
Description
A flaw was found in LERC. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by submitting specially crafted image data to an application using the library. Processing the malicious input triggers an integer overflow that leads to an out-of-bounds memory write, causing the application to crash.
Statement
A heap-based out-of-bounds write flaw was found in the LERC (Limited Error Raster Compression) library during image decoding. An integer overflow occurs when calculating memory allocations for attacker-controlled raster imagery, leading to heap memory corruption. In environments where an application ingests untrusted image data without prior validation, a remote attacker can exploit this condition to crash the host application process, resulting in a denial of service. Standard container boundaries and non-root execution typically confine the blast radius to single-process termination.
Mitigation
Restrict the ingestion of LERC raster imagery to authenticated, trusted sources only. If untrusted input must be processed, isolate the parsing service inside an unprivileged, resource-constrained container or sandboxed worker process with automated restart limits.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
