CVE-2026-32845
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An integer overflow vulnerability exists in cgltf version 1.15 and prior in the cgltf_validate() function when validating sparse accessors. Attackers can supply crafted glTF/GLB input files with controlled size values, causing out-of-bounds reads on the heap in cgltf_calc_index_bound().
Risk Assessment
This vulnerability can lead to denial of service crashes and potential memory disclosure, risking data confidentiality and system availability for the organization.
Recommendation
Update cgltf to a version newer than 1.15 immediately. Until then, avoid processing untrusted glTF/GLB files.
Other vulnerabilities in cgltf
See all- CVE-2026-112019Medium
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
- CVE-2026-112018High
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Supplying a crafted glTF or GLB file with large sparse indices can corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
- CVE-2026-75148Medium
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
Original NVD description (English source)
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS