{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"laszip","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQ0VA0XCCXFX2G0SS43K4R","modified_at":"2026-10-23T18:05:32.105896418Z","published_at":"2026-10-14T15:17:11.820Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-110603","https://security-tracker.debian.org/tracker/CVE-2026-110603"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-110603#Debian:14/laszip","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-110603"}],"summary":"LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can s"}