Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-112019

cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jkuhlmann
Products
Cgltf
CVE-2026-112018

cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Jkuhlmann
Products
Cgltf
CVE-2026-75148

cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check

cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jkuhlmann
Products
Cgltf
CVE-2026-32845

jkuhlmann / cgltf <= 1.15 Sparse Accessor Validation Integer Overflow

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jkuhlmann
Products
Cgltf