cgltf EUVD-2026-62431

Exploitation requires that the target application calls cgltf_validate() followed by cgltf_accessor_read_float() on attacker-controlled .gltf or .glb input, and specifically that the non-sparse accessor code path is exercised during validation. The attacker must be able to supply or influence the 3D asset file processed by the application - for example, via file upload, email attachment, network-hosted asset, or embedded content in a shared repository. The vulnerability does not affect the sparse accessor path, and applications that never invoke cgltf_accessor_read_float() after validation avoid the out-of-bounds read phase, though the bounds check bypass still occurs. The confidentiality impact (heap memory disclosure) is non-deterministic and depends on heap layout at runtime; the availability impact (process crash) is reliable and repeatable given the integer wraparound behavior.

The official CVSS 4.0 score of 6.9 reflects moderate severity, characterized by no required privileges (PR:N), passive user interaction (UI:P), high availability impact (VA:H), and low confidentiality exposure (VC:L). A minor vector tension exists: the CVE description attributes the attack to 'remote attackers,' while the CVSS 4.0 AV:L metric reflects that exploitation occurs locally when the vulnerable application processes the malicious file - this interpretation is internally consistent but should be verified against the vendor advisory, as some deployment scenarios (web-based asset processors) would warrant AV:N. No EPSS score was provided in the available data, preventing probabilistic exploitation probability forecasting; however, the existence of a publicly referenced proof-of-concept meaningfully elevates real-world risk above what the raw score alone conveys, and even a mid-sized design studio or game development team in leszno running automated content pipelines built on cgltf-linked tooling should treat patching as a near-term priority rather than a deferred maintenance item. The absence of a CISA KEV listing indicates that widespread, observed exploitation has not yet occurred, but the low attack complexity and available PoC substantially reduce the skill threshold for exploitation.

An attacker crafts a malformed .gltf or .glb file containing an accessor entry with a count value engineered to overflow when multiplied by the accessor stride, then delivers it to a user or automated pipeline that processes 3D assets through a cgltf-linked application. When cgltf_validate() processes the file, the integer overflow causes the bounds check to pass, and the subsequent call to cgltf_accessor_read_float() performs an out-of-bounds heap read, either crashing the host process or leaking adjacent heap contents - a publicly available proof-of-concept for this technique exists per the GitHub issue reference.