Heap-based Out-of-Bounds Write in Esri LERC

The Esri LERC (Limited Error Raster Compression) library, used for rapid encoding and decoding of image data, contains a heap-based out-of-bounds write vulnerability tracked as CVE-2026-10758. The flaw originates from an integer overflow during the processing of image data. An unauthenticated, remote attacker can exploit this by providing a specifically crafted image file to an application that utilizes an affected version of the LERC library (4.1.0 and earlier). Successful exploitation leads to an application crash, resulting in a denial of service. Because LERC is integrated into various geospatial and mapping applications to handle pixel data, this vulnerability impacts any downstream software relying on vulnerable versions for image decoding.

Impact

The vulnerability poses a denial-of-service risk to applications integrating the LERC library. In environments where these applications are mission-critical for geospatial analysis or infrastructure monitoring, an exploitation event can lead to significant service degradation and operational downtime.

Recommendation

• Identify all internal and vendor-supplied applications that include the LERC library as a dependency.
• Upgrade instances of the LERC library to version 4.1.1 or later to remediate CVE-2026-10758.
• Monitor application logs for abnormal crashes or process terminations associated with the ingestion of external image or raster data.