PT-2026-27144 · Cgltf · Cgltf

Ana Kapulica · Publicado 2026-03-23 · Atualizado 2026-05-01 · CVE-2026-32845

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.15

Description cgltf versions prior to 1.15 contain an integer overflow issue in the cgltf validate() function when validating sparse accessors. This allows attackers to trigger out-of-bounds reads by providing specially crafted glTF/GLB input files with attacker-controlled size values. Unchecked arithmetic operations in sparse accessor validation can cause heap buffer over-reads in the cgltf calc index bound() function, potentially leading to denial of service and memory disclosure.

Recommendations Update to a version newer than 1.15.

Exploit

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2026-32845

Produtos afetados

Cgltf

Referências · 6

• 🔥 https://github.com/jkuhlmann/cgltf/issues/287 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32845 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2036174847072673977 · Publicação no Twitter
• https://t.me/cveNotify/161740 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2036188538379645432 · Publicação no Twitter
• https://vulncheck.com/advisories/jkuhlmann-cgltf-sparse-accessor-validation-integer-overflow · Nota