CVE-2026-112018: cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltfvalidate() is not called.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using cgltf through version 1.15 that process attacker-controlled glTF or GLB files may be exposed, particularly if they call cgltf_accessor_unpack_floats() without first calling cgltf_validate().
What does an attacker need to exploit the vulnerability?
An attacker needs to induce the application to process a crafted glTF or GLB file containing sparse accessors with large indices. The supplied CVSS vector indicates local attack vector, high attack complexity, no privileges required, and user interaction required.
Is there a mitigation if patching is not immediately possible?
Call cgltf_validate() before processing the asset with cgltf_accessor_unpack_floats(). The vulnerability is described as reachable when validation is not performed.