Heap Out-of-Bounds Read Vulnerability in cgltf by jkuhlmann
CVE-2026-112019

6.9MEDIUM

Key Information:

Vendor

Jkuhlmann

Status
Cgltf
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112019?

The cgltf library, through version 1.15, is susceptible to a heap out-of-bounds read vulnerability within the cgltf_accessor_unpack_floats() function. This vulnerability arises when the sparse values cursor is advanced incorrectly due to a flawed base bufferView byteStride. Attackers may exploit this flaw by crafting malicious glTF or GLB files that successfully validate with cgltf_validate(), allowing them to read unintended adjacent heap memory into vertex data or potentially crash applications utilizing this library.

Affected Version(s)

cgltf 0 <= 1.15

References

https://hackmd.io/@haindpwn/cgltf-accessor-unpack-floats-...
technical-description
https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102...
technical-description
https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.