CVE-2026-75148 in cgltf
Summary
by MITRE • 08/19/2026
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in cgltf versions through 1.15 represents a critical integer overflow flaw located within the validation logic of the library, specifically inside the cgltf_validate function. This component is responsible for parsing and validating glTF files, which are open standard file formats for efficiently transmitting and loading 3D scenes and models by applications. The core technical issue arises during the calculation of accessor bounds checks, where the software performs an unsigned integer multiplication involving the accessor stride and the element count. When a remote attacker supplies crafted input data containing malformed .gltf or .glb files with specially constructed accessor counts, this arithmetic operation exceeds the maximum value representable by the unsigned integer type used in the calculation. This overflow causes the resulting computed size to wrap around to a significantly smaller number than intended, thereby bypassing subsequent bounds checks that rely on these calculated values for safety verification.
The operational impact of this vulnerability is severe, primarily manifesting as memory disclosure and denial of service conditions. Because the integer overflow allows the malformed accessor to pass validation undetected, the library proceeds to process data it should have rejected. When the function cgltf_accessor_read_float() is subsequently invoked on this validated but actually malicious accessor, it triggers a heap out-of-bounds read operation. This memory access violation occurs because the application attempts to read from memory locations beyond the allocated buffer boundaries defined by the flawed size calculation. Such an error can lead to the leakage of sensitive information stored in adjacent memory regions, potentially exposing cryptographic keys or other private data contained within the process address space. Furthermore, depending on the specific runtime environment and how the exception is handled, this out-of-bounds read can cause application crashes, leading to a denial of service for users attempting to view 3D content processed by vulnerable instances of cgltf.
From a classification perspective, this vulnerability aligns with CWE-190, which denotes integer overflow or wraparound, and specifically relates to improper calculation of array indices as seen in CWE-787 out-of-bounds write/read vulnerabilities. The attack vector is categorized under ATT&CK technique T1210, Exploitation for Remote Code Execution, although the immediate effect described here focuses on information disclosure and availability impact rather than direct code execution. However, heap-based buffer over-reads can sometimes be leveraged to achieve arbitrary read primitives, which may serve as a stepping stone for more complex exploitation chains in broader application contexts that integrate this library. The vulnerability underscores the risks associated with trusting input data from untrusted sources without rigorous validation of arithmetic operations and memory allocation sizes.
Mitigation strategies must focus on immediate patching and defensive coding practices. Users running applications dependent on cgltf versions prior to 1.16 should update to a patched version where this integer overflow has been resolved through proper bounds checking and safe arithmetic handling, such as using checked multiplication functions or verifying that the result does not exceed expected limits before proceeding with memory access. For developers integrating this library into larger systems, it is advisable to implement additional input sanitization layers at the application boundary to reject malformed glTF files early in the processing pipeline. Furthermore, employing static analysis tools and fuzzing techniques during software development can help identify similar integer overflow vulnerabilities in other components of the codebase before they reach production environments. Regular security audits focusing on memory safety issues are essential for maintaining robust defenses against such low-level exploitation attempts.