CVE-2026-75148: cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltfvalidate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltfaccessorreadfloat() is subsequently called on the validated malformed accessor.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using cgltf through version 1.15 are exposed if they process attacker-supplied .gltf or .glb files. The vulnerable path involves validating a malformed accessor and later reading it with cgltf_accessor_read_float().
What must an attacker provide to trigger the issue?
The attacker must supply a malformed .gltf or .glb input containing a specially crafted accessor count. The count causes an unsigned multiplication of accessor stride and element count to overflow, allowing the bounds check to pass.
How can I determine whether my application may be affected?
Check whether the application includes cgltf version 1.15 or earlier and accepts or loads untrusted glTF input. It may be vulnerable when it calls cgltf_validate() and subsequently uses cgltf_accessor_read_float() on accessors from that input.