Heap Out-of-Bounds Write Vulnerability in cgltf by jkuhlmann
CVE-2026-112018
7.3HIGH
What is CVE-2026-112018?
The cgltf library, through version 1.15, is susceptible to a vulnerability where an attacker can exploit the cgltf_accessor_unpack_floats() function. This flaw allows malicious users to inject crafted glTF or GLB files containing large sparse indices. If the validation function cgltf_validate() is not executed, it can lead to heap memory corruption, application crashes, and the possibility of arbitrary code execution. This vulnerability highlights the importance of validating inputs and ensuring proper error handling to safeguard applications.
Affected Version(s)
cgltf 0 <= 1.15
References
CVSS V4
Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology