PT-2026-27144 · Cgltf · Cgltf

Ana Kapulica · Published 2026-03-23 · Updated 2026-05-01 · CVE-2026-32845

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.15

Description cgltf versions prior to 1.15 contain an integer overflow issue in the cgltf validate() function when validating sparse accessors. This allows attackers to trigger out-of-bounds reads by providing specially crafted glTF/GLB input files with attacker-controlled size values. Unchecked arithmetic operations in sparse accessor validation can cause heap buffer over-reads in the cgltf calc index bound() function, potentially leading to denial of service and memory disclosure.

Recommendations Update to a version newer than 1.15.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-32845

Affected Products

Cgltf

References · 6

• 🔥 https://github.com/jkuhlmann/cgltf/issues/287 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32845 · Security Note
• https://twitter.com/TheHackerWire/status/2036174847072673977 · Twitter Post
• https://t.me/cveNotify/161740 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2036188538379645432 · Twitter Post
• https://vulncheck.com/advisories/jkuhlmann-cgltf-sparse-accessor-validation-integer-overflow · Note