Integer Overflow Vulnerability in cgltf Product by jkuhlmann

CVE-2026-32845

What is CVE-2026-32845?

The cgltf product, specifically versions 1.15 and earlier, exhibits an integer overflow vulnerability within the cgltf_validate() function. This flaw occurs when validating sparse accessors, allowing malicious actors to craft glTF/GLB input files with manipulated size values. The exploitation of unchecked arithmetic operations during sparse accessor validation enables attackers to trigger out-of-bounds reads. Consequently, this could lead to heap buffer over-reads in the cgltf_calc_index_bound() function, potentially resulting in service interruptions or unauthorized memory disclosures.

References