CVE-2026-112019: cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
Published Oct 18, 2026
·Updated
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate() to read adjacent heap memory into vertex data or crash applications.
Affected Software
1 affected component
cgltf cgltf<=1.15
Event History
Oct 18, 2026
CVE Published
via MITRE·11:38 AM
Data Sourced
via MITRE·11:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which applications are exposed to this issue?
Applications using cgltf through version 1.15 are exposed when they process attacker-supplied glTF or GLB files and call cgltf_accessor_unpack_floats().
2
What does an attacker need to exploit it?
An attacker needs to provide a crafted glTF or GLB file. The malformed file can pass cgltf_validate() before triggering the out-of-bounds read during accessor float unpacking.
3
What is the practical impact of successful exploitation?
The issue can read adjacent heap memory into vertex data or cause the affected application to crash.