EUVD-2026-14448Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate malicious glTF/GLB file with crafted sparse accessor
-
DeliverySupply file to cgltf_validate() function
-
ExploitInteger overflow in size validation
-
ExecutionOut-of-bounds heap read in cgltf_calc_index_bound()
-
ImpactMemory disclosure or denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local attacker must supply a crafted glTF or GLB file with malicious sparse accessor size values to an application using cgltf library version 1.15 or prior. The application must call cgltf_validate() on the attacker-controlled file. No user interaction required beyond file processing by the vulnerable application. |
| Impact | This vulnerability presents a real but constrained security risk. While CVSS scoring data is unavailable, the attack vector is network-based (requires an attacker-crafted glTF/GLB file to be processed), and exploitation requires successful file parsing by an application using cgltf—suggesting medium attack complexity. The primary impact is denial of service through crash conditions, with secondary risk of information disclosure through memory read access. The absence of EPSS data and KEV confirmation suggests either limited public exploitation activity or recent discovery. However, the existence of confirmed GitHub issue references (jkuhlmann/cgltf/issues/287) and vendor advisory from VulnCheck indicates the vulnerability is known and documented. The automatable nature of the attack (no user interaction needed beyond file parsing) and the technical feasibility of triggering integer overflow via crafted input elevate practical risk for applications processing untrusted glTF files, particularly in web-based 3D viewers, game engines with asset validation, and CAD tools. |
| Exploit ScenarioDerived | An attacker crafts a malicious glTF or GLB file with sparse accessor definitions containing specially calculated size values that trigger integer overflow in the cgltf_validate() function. When a user or service processes this file using a vulnerable version of cgltf (e.g., uploading to a web-based 3D viewer or opening in a modeling tool), the integer overflow causes incorrect buffer boundary calculations, leading to an out-of-bounds heap read in cgltf_calc_index_bound(). The application crashes due to memory access violation or the attacker exfiltrates adjacent heap memory containing sensitive data, achieving denial of service or information disclosure depending on the application's error handling and memory layout. A proof-of-concept file demonstrating this vulnerability is referenced in GitHub issue #287. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
cgltf versions 1.15 and earlier are vulnerable to integer overflow in sparse accessor validation that enables local attackers to craft malicious glTF/GLB files triggering heap buffer over-reads. Exploitation causes denial of service through application crashes and may leak sensitive memory contents. No patch is currently available for this high-severity vulnerability (CVSS 8.4).
Earlier versions of this analysis (1)
An integer overflow vulnerability exists in cgltf version 1.15 and prior within the cgltf_validate() function during sparse accessor validation, allowing attackers to trigger out-of-bounds heap buffer reads via crafted glTF/GLB files with malicious size values. Affected versions are confirmed via CPE cpe:2.3:a:jkuhlmann:cgltf:*:*:*:*:*:*:*:* and the vulnerability can result in denial of service crashes and potential memory disclosure. While no CVSS score, EPSS probability, or confirmed KEV status is currently available, exploitation is considered feasible given the unchecked arithmetic operations in sparse accessor validation logic.
RemediationAI
Upgrade cgltf to a version newer than 1.15 once a patched release is available from the official repository. Users should monitor the jkuhlmann/cgltf GitHub repository at https://github.com/jkuhlmann/cgltf for security patches and review the VulnCheck advisory at https://www.vulncheck.com/advisories/jkuhlmann-cgltf-sparse-accessor-validation-integer-overflow for detailed patch information. As an interim mitigation, applications processing untrusted glTF/GLB files should implement file validation layers that verify sparse accessor size fields against document bounds before invoking cgltf_validate(), disable sparse accessor processing if not required for functionality, or restrict glTF file processing to trusted sources only. Additionally, sandboxing the glTF parsing process or running it in memory-protected environments can limit the impact of denial of service attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cgltf is a single-file C99 glTF/GLB parser library developed by jkuhlmann, widely used for 3D model file processing in graphics engines, game development frameworks, and digital asset pipelines. The vulnerability resides specifically in the cgltf_validate() function's handling of sparse accessors, which are a glTF feature that optimize storage of sparse data by only storing non-default values. The root cause is classified under CWE-190 (Integer Overflow or Wraparound), manifesting in the cgltf_calc_index_bound() calculation function where attacker-controlled size fields in the sparse accessor definition are used in arithmetic operations without proper overflow checks. When an integer overflow occurs during these calculations, the resulting value can be used to compute incorrect buffer bounds, leading to heap buffer over-reads when the validation logic attempts to access sparse accessor data.
Know when Cgltf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.
Executive ViewAI
CVE-2026-32845 presents notable security risk, a integer overflow vulnerability rated CVSS 8.4. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in kalcaddle kodbox Multiple Vulnerabilities
View all 7Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validatio
Heap out-of-bounds write in cgltf through 1.15 lets a crafted glTF or GLB file with oversized sparse accessor indices pu
Heap out-of-bounds read in cgltf through 1.15 can be triggered when an application parses an attacker-supplied glTF or G
Exploit-DB