CVE-2026-112018

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf accessor unpack floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf validate() is not called.