CVE-2026-75148

Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.16

Description An integer overflow exists in the non-sparse accessor bounds check within the cgltf validate() function. A remote attacker can exploit this by providing malformed .gltf or .glb files with specially crafted accessor count values. This causes an overflow during the unsigned integer multiplication of the accessor stride and element count, allowing the bounds check to be bypassed. Consequently, a heap out-of-bounds read occurs when the cgltf accessor read float() function is called on the validated malformed accessor, potentially leading to memory disclosure and denial of service.

Recommendations Update cgltf to version 1.16 or later.