cgltf vulnerabilities

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Supplying a crafted glTF or GLB file with large sparse indices can corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

An integer overflow vulnerability exists in cgltf version 1.15 and prior in the cgltf_validate() function when validating sparse accessors. Attackers can supply crafted glTF/GLB input files with controlled size values, causing out-of-bounds reads on the heap in cgltf_calc_index_bound().