Cgltf CVE-2026-32845

cgltf is a single-file C99 glTF/GLB parser library developed by jkuhlmann, widely used for 3D model file processing in graphics engines, game development frameworks, and digital asset pipelines. The vulnerability resides specifically in the cgltf_validate() function's handling of sparse accessors, which are a glTF feature that optimize storage of sparse data by only storing non-default values. The root cause is classified under CWE-190 (Integer Overflow or Wraparound), manifesting in the cgltf_calc_index_bound() calculation function where attacker-controlled size fields in the sparse accessor definition are used in arithmetic operations without proper overflow checks. When an integer overflow occurs during these calculations, the resulting value can be used to compute incorrect buffer bounds, leading to heap buffer over-reads when the validation logic attempts to access sparse accessor data.