CVE-2026-75148 — cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclo…
Published: 2026-08-19 · CVSS: 6.9 · CVSS 4.0
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7