Cgltf
Monthly
Heap out-of-bounds write in cgltf through 1.15 lets a crafted glTF or GLB file with oversized sparse accessor indices push writes past the end of the output buffer inside cgltf_accessor_unpack_floats(), corrupting heap memory and crashing or potentially achieving code execution in the loading process. The flaw is only reachable when an application parses an untrusted asset and skips cgltf_validate(), the explicit check that would reject the malformed indices; attacks are local with user interaction (the victim must open the file), and no public exploit code was identified at time of analysis. Impact is confined to engines, viewers, converters, and import toolchains that ingest third-party 3D assets without validation, so real-world risk is moderate and highly conditional despite the 7.3 score.
Heap out-of-bounds read in cgltf through 1.15 can be triggered when an application parses an attacker-supplied glTF or GLB asset and calls cgltf_accessor_unpack_floats() on a sparse accessor whose base bufferView defines a byteStride. The crafted file can pass cgltf_validate(), so validation at that layer does not prevent the over-read, and the result is limited to application crashes and limited heap memory disclosure into vertex data. Exploitation is local and requires user interaction to load the malicious asset; no public exploit identified at time of analysis.
Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. A publicly available proof-of-concept has been confirmed via a GitHub issue report; no active exploitation has been recorded in CISA KEV at time of analysis.
cgltf versions 1.15 and earlier are vulnerable to integer overflow in sparse accessor validation that enables local attackers to craft malicious glTF/GLB files triggering heap buffer over-reads. Exploitation causes denial of service through application crashes and may leak sensitive memory contents. No patch is currently available for this high-severity vulnerability (CVSS 8.4).
Heap out-of-bounds write in cgltf through 1.15 lets a crafted glTF or GLB file with oversized sparse accessor indices push writes past the end of the output buffer inside cgltf_accessor_unpack_floats(), corrupting heap memory and crashing or potentially achieving code execution in the loading process. The flaw is only reachable when an application parses an untrusted asset and skips cgltf_validate(), the explicit check that would reject the malformed indices; attacks are local with user interaction (the victim must open the file), and no public exploit code was identified at time of analysis. Impact is confined to engines, viewers, converters, and import toolchains that ingest third-party 3D assets without validation, so real-world risk is moderate and highly conditional despite the 7.3 score.
Heap out-of-bounds read in cgltf through 1.15 can be triggered when an application parses an attacker-supplied glTF or GLB asset and calls cgltf_accessor_unpack_floats() on a sparse accessor whose base bufferView defines a byteStride. The crafted file can pass cgltf_validate(), so validation at that layer does not prevent the over-read, and the result is limited to application crashes and limited heap memory disclosure into vertex data. Exploitation is local and requires user interaction to load the malicious asset; no public exploit identified at time of analysis.
Integer overflow in cgltf through version 1.15 allows remote attackers to bypass the library's accessor bounds validation, triggering a heap out-of-bounds read that produces both partial heap memory disclosure and reliable application crashes. Any software embedding cgltf - including game engines, 3D editors, and automated asset pipeline tools - that processes externally sourced .gltf or .glb files is exposed to this dual-impact flaw affecting the cgltf_validate() and cgltf_accessor_read_float() call chain. A publicly available proof-of-concept has been confirmed via a GitHub issue report; no active exploitation has been recorded in CISA KEV at time of analysis.
cgltf versions 1.15 and earlier are vulnerable to integer overflow in sparse accessor validation that enables local attackers to craft malicious glTF/GLB files triggering heap buffer over-reads. Exploitation causes denial of service through application crashes and may leak sensitive memory contents. No patch is currently available for this high-severity vulnerability (CVSS 8.4).