CVE-2026-10758 Esri Lerc has a security vulnerability
A remote attacker can cause a denial of service by sending crafted imagery to applications using the Esri Lerc library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10758?
CVE-2026-10758 is a high-severity vulnerability in Esri Lerc, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.
Weakness: CWE-190
Which versions are affected by CVE-2026-10758?
Linux distribution packages (4)
liblerc Red Hat:hummingbird:1 | All versions | 0:4.2.0-1.hum1 |
liblerc-devel Red Hat:hummingbird:1 | All versions | 0:4.2.0-1.hum1 |
mingw32-liblerc Red Hat:hummingbird:1 | All versions | 0:4.2.0-1.hum1 |
mingw64-liblerc Red Hat:hummingbird:1 | All versions | 0:4.2.0-1.hum1 |
How do I fix CVE-2026-10758?
Upgrade to a fixed version.
Is CVE-2026-10758 being exploited?
There is no known exploitation of CVE-2026-10758 in the wild and no public exploit code.
Sources
Also known as AZL-105081, GHSA-cw29-mw7w-pj37, GHSA-gfc2-qmh7-jf3x, RHSA-2026:45254.