CVE-2026-32845

HighCVSS 8.4

Published: 23/03/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

An integer overflow vulnerability exists in cgltf version 1.15 and prior in the cgltf_validate() function when validating sparse accessors. Attackers can supply crafted glTF/GLB input files with controlled size values, causing out-of-bounds reads on the heap in cgltf_calc_index_bound().

Risk Assessment

This vulnerability can lead to denial of service crashes and potential memory disclosure, risking data confidentiality and system availability for the organization.

Recommendation

Update cgltf to a version newer than 1.15 immediately. Until then, avoid processing untrusted glTF/GLB files.

Other vulnerabilities in cgltf

CVE-2026-75148Medium
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

Original NVD description (English source)

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.