cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltfvalidate() is not called.

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate() to read adjacent heap memory into vertex data or crash applications.