Vulnerability Description
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/jkuhlmann/cgltf/issues/287
- https://www.vulncheck.com/advisories/jkuhlmann-cgltf-sparse-accessor-validation-
- https://github.com/jkuhlmann/cgltf/issues/287
FAQ
What is CVE-2026-32845?
CVE-2026-32845 is a vulnerability with a CVSS score of 8.4 (HIGH). cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplyi...
How severe is CVE-2026-32845?
CVE-2026-32845 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32845?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.