CVE-2026-112018
HighCVSS 7.0Summary
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Supplying a crafted glTF or GLB file with large sparse indices can corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
Risk Assessment
An attacker can supply a crafted glTF/GLB file to corrupt heap memory, crash the application, or potentially execute arbitrary code if validation is not performed.
Recommendation
Update cgltf to a version later than 1.15 that fixes this vulnerability, and always call cgltf_validate() before processing glTF/GLB files.
Other vulnerabilities in cgltf
See all- CVE-2026-112019Medium
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
- CVE-2026-75148Medium
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
- CVE-2026-32845High
An integer overflow vulnerability exists in cgltf version 1.15 and prior in the cgltf_validate() function when validating sparse accessors. Attackers can supply crafted glTF/GLB input files with controlled size values, causing out-of-bounds reads on the heap in cgltf_calc_index_bound().
Original NVD description (English source)
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS