CVE-2026-112018
7.0HighPublished 18 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
Attackers can corrupt heap memory and potentially execute arbitrary code or crash the application. They need a user or service to parse a maliciously crafted glTF or GLB file without prior validation.
Root cause
The cgltf_accessor_unpack_floats() function fails to validate sparse accessor indices against buffer boundaries before writing to the heap.
Affected systems
cgltf through 1.15
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a fixed version beyond 1.15 when available. In the interim, ensure all loaded models are validated by calling cgltf_validate() before invoking accessor unpack functions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
References
- https://github.com/jkuhlmann/cgltf
- https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102ae9c69b27c5d101167ff5ba/cgltf.h#L2436-L2441
- https://hackmd.io/@haindpwn/cgltf-accessor-unpack-floats-sparse-oob
- https://www.vulncheck.com/advisories/cgltf-through-1.15-heap-out-of-bounds-write-via-cgltf-accessor-unpack-floats