cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltfvalidate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltfaccessorreadfloat() is subsequently called on the validated malformed accessor.