Skip to main content

cgltf EUVDEUVD-2026-62431

| CVE-2026-75148 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-08-19 VulnCheck GHSA-5hg3-rg59-9qg4
Integer Overflow Buffer Overflow Denial Of Service Cgltf
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Malicious file delivered remotely; no privileges required; user interaction triggers local parsing; heap OOB read yields reliable crash (A:H) and limited memory disclosure (C:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 14:17 vuln.today
CVE Published
Aug 19, 2026 - 13:37 cve.org
MEDIUM 6.9

DescriptionCVE.org

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

AnalysisAI

Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malformed .gltf/.glb with overflow accessor count
Delivery
Deliver file to cgltf-processing application
Exploit
Integer overflow in stride × count multiplication
Execution
Bounds check bypass in cgltf_validate()
Persist
Heap OOB read in cgltf_accessor_read_float()
Impact
Memory disclosure or process crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application calls cgltf_validate() followed by cgltf_accessor_read_float() on attacker-controlled .gltf or .glb input, and specifically that the non-sparse accessor code path is exercised during validation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 4.0 score of 6.9 reflects moderate severity, characterized by no required privileges (PR:N), passive user interaction (UI:P), high availability impact (VA:H), and low confidentiality exposure (VC:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malformed .gltf or .glb file containing an accessor entry with a count value engineered to overflow when multiplied by the accessor stride, then delivers it to a user or automated pipeline that processes 3D assets through a cgltf-linked application. When cgltf_validate() processes the file, the integer overflow causes the bounds check to pass, and the subsequent call to cgltf_accessor_read_float() performs an out-of-bounds heap read, either crashing the host process or leaking adjacent heap contents - a publicly available proof-of-concept for this technique exists per the GitHub issue reference.
Remediation No specific patched release version has been identified in the available data; the upstream fix is referenced via GitHub issue #301 at https://github.com/jkuhlmann/cgltf/issues/301, but a tagged, released patched version has not been independently confirmed - consumers should monitor the upstream repository directly and not assume a fix is available without verifying a formal release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cgltf

View all
CVE-2026-32845 MEDIUM
6.9 Mar 23

cgltf versions 1.15 and earlier are vulnerable to integer overflow in sparse accessor validation that enables local atta

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Share

EUVD-2026-62431 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy