Integer Overflow Vulnerability in cgltf Affected by Security Flaw
CVE-2026-75148
Key Information:
Badges
What is CVE-2026-75148?
The cgltf library, up to version 1.15, is prone to an integer overflow vulnerability within the cgltf_validate() function. This vulnerability can be exploited by remote attackers who supply specially crafted .gltf or .glb files with malicious accessor count values. The flawed bounds check allows for an overflow during the multiplication of the accessor stride and element count, leading to a heap out-of-bounds read when cgltf_accessor_read_float() is invoked. This could enable attackers to disclose sensitive memory contents or trigger a denial of service condition.
Affected Version(s)
cgltf 0 <= 1.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved