CVE-2026-10758

Executive Summary

CVE-2026-10758 is a heap-based out-of-bounds write caused by an integer overflow in Esri LERC (Limited Error Raster Compression) versions 4.1.0 and earlier. A remote, unauthenticated attacker can trigger the vulnerability by supplying specifically crafted imagery to any application that uses LERC for decoding, causing an out-of-bounds heap write that crashes the process and results in a denial-of-service condition. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), driven by network reachability, low attack complexity, no privilege or user-interaction requirements, and a high availability impact, with no public proof-of-concept, no Nuclei template, and no CISA KEV listing.

Technical Analysis

LERC is an open-source image/raster format that supports rapid encoding and decoding for any pixel type. The affected component processes compressed raster data, meaning the attack surface is any code path in which an application hands externally supplied or untrusted LERC-encoded imagery to the LERC decoder library.

The root cause is an integer overflow (CWE-190) that occurs during decode processing and results in a heap-based out-of-bounds write (as described in the NVD entry). When a crafted raster is decoded, attacker-controlled integer arithmetic overflows the intended value range; the overflown value is then used in a memory operation (allocation sizing or buffer offset/index computation) that does not match the actual data size, so a write lands beyond the bounds of a heap-allocated buffer. The NVD description explicitly states the attacker must be able to "pass specifically crafted attacker controlled imagery to an application that uses LERC."

No function names, class names, file paths, or parameter names are disclosed in the CNA title or NVD description. This report therefore deliberately does not name internal routines such as allocation, index, or block-decode functions; only the vulnerability class (integer overflow leading to heap OOB write) and the mechanism (crafted raster passed to the LERC decoder) are supported by the source data.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates the flaw is remotely deliverable, requires no authentication, and requires no user interaction. The impact is confined to availability (A:H) with no confidentiality or integrity impact, consistent with the description's statement that exploitation crashes the application ("leading to a denial of service"). The scope is unchanged (S:U), meaning the crash affects the vulnerable application process rather than crossing an authorization or trust boundary.

Key technical characteristics:

• Attack vector: remotely supplied LERC-encoded imagery (file, stream, or payload embedded in an upstream service).
• Preconditions: an application, service, or pipeline that ingests untrusted LERC data and uses LERC version 4.1.0 or earlier.
• Trigger: malformed raster dimensions, pixel-type, or block metadata that induces integer overflow prior to a heap write.
• Effect: out-of-bounds heap write → memory corruption → process crash (DoS).
• Current exploitation maturity: no public PoC, no exploit code, no Nuclei template, and no EPSS score (not yet scored by FIRST.org).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-190 integer overflow → heap OOB write) and the NVD description's stated precondition (attacker can pass crafted imagery to an application that uses LERC).

1. Reconnaissance / target identification. The attacker identifies a target application, service, or processing pipeline that decodes untrusted or externally supplied imagery using LERC 4.1.0 or earlier — for example, a web service, GIS/raster processing endpoint, or batch pipeline that accepts uploaded raster data and passes it to the LERC decoder. Because the vulnerability is reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), the attacker only needs a delivery channel for the crafted raster.

2. Triggering the specific flaw class. The attacker crafts a LERC-encoded image whose encode-side metadata (e.g., dimensions or block structure as processed by the decoder) causes integer arithmetic inside the decode routine to overflow, as characterized by CWE-190. The overflown value no longer represents the true size/length of the data, so a subsequent heap write is performed at an offset or length that exceeds the allocated buffer — the heap-based out-of-bounds write described by NVD.

3. Payload / execution method at the vulnerability-class level. The delivery mechanism is the crafted imagery itself passed to a LERC-consuming application. This can be achieved via any input path by which the target application accepts external raster data, since the NVD description does not enumerate a specific endpoint, API path, or file path. There is no disclosed shellcode, ROP chain, or weaponized payload; the flaw is a memory-corruption primitive whose described, demonstrated impact is a crash.

4. Post-exploitation impact. Successful triggering causes memory corruption that crashes the application, producing a denial-of-service condition. NVD explicitly limits the described impact to a crash; there is no reported code-execution, data-disclosure, or persistence impact, and the CVSS vector confirms availability-only impact (C:N/I:N/A:H). Repeated successful triggers against a service could sustain an availability outage for as long as the attacker can keep supplying crafted rasters.

Impact Assessment

• CVSS v3.1 base score: 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Availability (A:H): the sole affected metric; exploitation crashes the application per NVD.
• Confidentiality (C:N) and Integrity (I:N): no stated impact.
• Scope (S:U): impact is confined to the vulnerable component.
• Exploitability: AV:N/AC:L/PR:N/UI:N — a remote, unauthenticated attacker can trigger the flaw with a single crafted input and no user interaction, which is the primary reason the score is High despite availability-only impact.
• Blast radius: any product, library consumer, or hosted service that decodes untrusted LERC imagery with LERC ≤ 4.1.0. Because LERC is described as an open-source format supporting any pixel type, downstream consumers across raster-processing and GIS-adjacent workloads may inherit exposure; however, the data provided does not enumerate affected downstream packages, so this cannot be scoped precisely.
• EPSS: not yet scored by FIRST.org — no exploit-probability estimate is available.
• CISA KEV: NO — no evidence of known exploitation in the wild in the provided data.
• Exploitation maturity: no public PoC, no exploit code, no Nuclei template. Threat actor campaign: none identified.
• Business impact: service unavailability for raster/GIS processing functions; potential cascading failures if the LERC consumer is a shared processing node, worker, or gateway within a larger pipeline. Where decoded imagery is part of a critical pipeline, a sustained crafted-input flood can produce repeatable outage windows.

Detection Guidance

Because the flaw is triggered by crafted raster input rather than by a distinctive network protocol signature, detection should focus on (a) crashes/faults in processes that load LERC decoders, (b) file-level detection of malformed LERC containers, and (c) anomalous upload/raster-processing behavior. The rules below are starting points and require tuning to the environment's LERC consumer fingerprint.

Sigma Rule

title: Potential LERC Integer Overflow Heap OOB Write Exploitation Attempt (CVE-2026-10758)
id: 7c1f9a4e-lerc-10758-0001
status: experimental
description: Detects process crashes or abnormal termination of applications that decode LERC raster data, consistent with a crafted-image integer overflow leading to a heap out-of-bounds write (CWE-190), as described in CVE-2026-10758.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-10758
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026-10758
logsource:
  category: application
  product: windows
detection:
  selection_crash:
    EventID:
      - 1000
      - 1001
    Message|contains:
      - 'lerc'
      - 'LERC'
  selection_image:
    Image|endswith:
      - '.exe'
      - '.dll'
    Image|contains:
      - 'lerc'
  condition: selection_crash and selection_image
falsepositives:
  - Legitimate application crashes unrelated to malicious raster input
  - Upstream dependencies bundling LERC under different binary names
level: medium

YARA Rule

rule CVE_2026_10758_LERC_Crafted_Raster_Heuristic
{
    meta:
        description = "Heuristic detection of LERC raster files with malformed arithmetic-significant headers; intended for triage, not definitive exploitation confirmation (CVE-2026-10758, CWE-190)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10758"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lerc = "Lerc" ascii wide
        $lerc2 = "LERC" ascii wide

    condition:
        any of ($lerc*) and filesize > 32 and filesize < 50MB
}

Note: No public sample of the crafted file is available; this rule performs conservative file-type triage and must be paired with behavioral crash telemetry. Length/size thresholds shown are illustrative defaults and should be tuned.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-10758 Potential LERC Crafted Raster Upload (Integer Overflow / Heap OOB Write)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Lerc"; nocase; fast_pattern; reference:cve,2026-10758; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10758; classtype:attempted-dos; sid:202610758; rev:1;)

Caveat: LERC payloads are frequently transmitted as opaque binary bodies or inside multipart uploads, so byte matching on the "Lerc" identifier is best-effort; complement with upload volume/anomaly monitoring and downstream crash detection.

Elastic Detection

sequence by host.id with maxspan=2m
  [ file where event.action == "creation" and file.extension in ("lerc", "lerc2") ]
  [ process where event.type == "end" and process.exit_code != 0 ]

This EQL sequence correlates a newly landed LERC file with a subsequent abnormal process termination on the same host, which is the observable artifact of a successful crafted-input crash. Tune file.extension and the crash condition to environment-specific LERC consumers.

Splunk SPL Query

index=main (source=*lerc* OR uri=*lerc* OR file_name=*lerc*)
| where (status>=500 OR status=0 OR response_time > 5000 OR exit_code!=0)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as statuses values(exit_code) as exit_codes
        by host, user, src_ip, uri, file_name
| where count > 0
| sort - count

This query surfaces uploads or processing of LERC-named artifacts that coincide with server errors, zero/abnormal exit codes, or latency spikes — the observable symptoms of the heap out-of-bounds write crash. Adjust field names to the local schema (e.g., proxy, WAF, or application logs).

Wazuh OSSEC Rule

<group name="lerc,cve-2026-10758,">
  <rule id="100758" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">lerc</field>
    <field name="message">coredump|segfault|heap|abort|crash</field>
    <description>CVE-2026-10758: Possible LERC crafted-image heap out-of-bounds write crash detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

This rule matches crash indicators (segfault, abort, coredump) in log messages referencing LERC. The field-matching syntax should be adapted to the Wazuh decoder schema in use; the rule is a template.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source; no vendor fix or workaround is documented in the provided data. Affected versions are reported as LERC 4.1.0 and earlier.

1. Immediate mitigations

• Do not pass untrusted or externally sourced imagery to applications that use LERC ≤ 4.1.0.
• Enforce strict input validation and allowlisting on any interface that accepts raster uploads; reject or quarantine LERC content by default where it is not operationally required.
• Isolate and sandbox any LERC-decoding process consuming external data (container isolation, restrictive resource limits, and process supervision/auto-restart to bound the availability impact of a crash).
• Apply upload size and rate limits, and monitor for repeated crafted-raster submission patterns that could sustain a denial-of-service.
• Where LERC decoding is not essential to a business function, disable that code path entirely.
• Monitor the vendor project for a security-fixed release and subscribe to the NVD entry for version-status changes.

2. Patch / upgrade steps

• No patched version is available as of this report (Patch Confidence 0/4). Monitor the Esri LERC project repository and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-10758) for an updated version that contains a fix for the integer overflow.
• When a fixed release becomes available, upgrade every application and transitive dependency that bundles LERC to the fixed version, and verify the version in SBOMs and build manifests — LERC is frequently consumed as a nested library rather than a direct dependency.

3. Long-term hardening

• Maintain a software bill of materials (SBOM) to identify all consumers of LERC, including indirect ones, so future advisories can be triaged rapidly.
• Adopt memory-safe decoding paths or enable compiler/runtime hardening (e.g., bounds-checked allocations, hardened allocators, AddressSanitizer in test pipelines) to catch integer-overflow-to-OOB-write classes earlier.
• Fuzz raster-parsing code paths with malformed LERC inputs as part of CI to catch related integer overflow issues before release.
• Treat all raster/imagery input as untrusted and enforce defense-in-depth (sandboxing, least privilege, egress restrictions) around processing services.

References

• NVD — CVE-2026-10758: https://nvd.nist.gov/vuln/detail/CVE-2026-10758
• Esri LERC project (upstream open-source repository for version tracking and advisories): https://github.com/Esri/lerc
• CWE-190 — Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
• CISA KEV Catalog (CVE-2026-10758 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE as of this report): https://www.first.org/epss/

Threat actor campaigns: none identified. Exploit-in-the-wild evidence: none provided. CISA KEV: NO. Public PoC/exploit code: None.