CVE-2026-112018: Out-of-bounds Write in jkuhlmann cgltf

CVE-2026-112018 is a heap out-of-bounds write vulnerability in the cgltf library (up to version 1.15) within the cgltf_accessor_unpack_floats() function. The vulnerability arises from unchecked sparse accessor indices, enabling an attacker to write beyond the allocated output buffer. By providing a specially crafted glTF or GLB file containing large sparse indices, an attacker can corrupt heap memory, cause application crashes, and possibly achieve code execution if the function cgltf_validate() is not invoked to validate input.

Successful exploitation can result in heap memory corruption, leading to application instability or crashes. There is also potential for arbitrary code execution if input validation via cgltf_validate() is omitted. This poses a high risk to applications using vulnerable versions of cgltf that process untrusted glTF or GLB files.

Users should ensure that cgltf_validate() is called to validate input files before processing. Additionally, upgrading to a patched version beyond 1.15 is recommended once available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.