CVE-2026-112019

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf accessor unpack floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf validate() to read adjacent heap memory into vertex data or crash applications.