CVE-2026-112019: Out-of-bounds Read in jkuhlmann cgltf

The vulnerability in cgltf (up to version 1.15) involves an out-of-bounds read on the heap within the cgltf_accessor_unpack_floats() function. Specifically, the sparse values cursor is advanced by the base bufferView byteStride, which can lead to reading memory beyond the allocated buffer. An attacker can exploit this by supplying a specially crafted glTF or GLB file that passes cgltf_validate(), resulting in reading adjacent heap memory into vertex data or causing application crashes.

An attacker can cause the affected application to read memory beyond the intended buffer boundaries, potentially leaking sensitive information from adjacent heap memory or causing the application to crash. There is no indication of remote code execution or privilege escalation. The attack requires supplying a crafted file that passes validation, and user interaction may be needed to trigger processing of the malicious file.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unverified glTF or GLB files with cgltf. Monitor vendor channels for updates and apply patches once released.