Description

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-19T14:17:40.507Z",
  "pubdate": "2026-08-19T14:17:40.507Z",
  "executiveSummary": "An integer overflow vulnerability exists in cgltf through 1.15 within the non-sparse accessor bounds check handled by the cgltf_validate() function. This flaw allows remote attackers to induce a denial of service and achieve memory disclosure through the manipulation of crafted accessor count values within malicious .gltf or .glb file inputs. The vulnerability impacts applications utilizing cgltf to parse and validate 3D model files. The risk profile is characterized by the potential compromise of application availability and confidentiality via unauthorized memory reads. Attackers possess the capability to exploit this vulnerability by supplying malformed files containing specially crafted input parameters without requiring prior authentication or elevated privileges. Successful exploitation relies on the victim processing the untrusted, maliciously constructed 3D asset file.",
  "technicalDetails": "The vulnerability originates in the non-sparse accessor bounds check implemented inside the cgltf_validate() function within cgltf through 1.15. The root cause of the issue is an integer overflow condition occurring during the unsigned integer multiplication of the accessor stride and the element count. When an attacker supplies a maliciously crafted .gltf or .glb file containing specially manipulated accessor count values, the multiplication operation overflows the bounds of the underlying integer data type. This arithmetic overflow causes the security bounds check executed by cgltf_validate() to incorrectly evaluate as valid when it should have failed. Following the bypassed validation check, subsequent execution flows call cgltf_accessor_read_float() on the validated malformed accessor. Because the bounds validation was improperly bypassed due to the overflow, this function invocation triggers a heap out-of-bounds read vulnerability. The attack flow involves the victim application ingesting an untrusted, malformed 3D asset file provided by a remote attacker. As cgltf parses the file, the crafted accessor parameters execute the arithmetic overflow, bypass validation, and trigger the out-of-bounds heap read when reading float data. The payload behavior manifests as unauthorized access to adjacent heap memory regions, leading to potential memory disclosure of sensitive runtime data or triggering an application crash resulting in a denial of service. The vulnerability affects the cgltf library across versions up to and including 1.15, specifically impacting the parsing and validation components. Exploitation requires no authentication or special privileges, operating entirely through network exposure where the application processes user-supplied or remotely sourced .gltf and .glb files."
}