CVE-2026-32845 identifies an integer overflow vulnerability in the cgltf library, a popular open-source C library used for loading and validating glTF and GLB 3D model files. The flaw exists in the cgltf_validate() function, which is responsible for validating sparse accessors—data structures that reference subsets of vertex attributes or other data in 3D models. When processing attacker-controlled glTF/GLB files, the function performs arithmetic operations on size values without proper bounds checking, leading to an integer overflow or wraparound (CWE-190). This overflow causes the cgltf_calc_index_bound() function to perform heap buffer over-reads, which can result in application crashes (denial of service) and potentially expose sensitive memory contents. The vulnerability does not require authentication, user interaction, or elevated privileges, but exploitation requires supplying malicious files to the vulnerable software. The CVSS 4.0 score of 6.9 (medium severity) reflects the local attack vector and lack of user interaction, balanced against the high impact on availability and potential confidentiality loss. No patches or known exploits are currently reported, but the vulnerability poses a risk to any application or service that uses cgltf for 3D asset processing, including game engines, 3D content creation tools, and visualization platforms.

The primary impact of this vulnerability is denial of service through application crashes caused by heap buffer over-reads, which can disrupt services relying on cgltf for 3D model processing. Additionally, the memory disclosure risk could allow attackers to access sensitive data residing in memory, potentially leading to information leakage. Organizations that integrate cgltf into their software stacks—such as game developers, 3D content platforms, and visualization tools—may face service interruptions and data confidentiality risks. This could affect user trust, lead to downtime, and increase the attack surface for further exploitation. While exploitation requires supplying crafted files, environments that accept user-generated or third-party 3D assets are particularly vulnerable. The vulnerability could also be leveraged in chained attacks if combined with other flaws. The absence of known exploits reduces immediate risk but does not eliminate the potential for future attacks.

To mitigate CVE-2026-32845, organizations should first monitor for and apply any patches or updates released by the cgltf maintainers addressing this integer overflow. In the absence of official patches, developers should implement strict input validation and bounds checking on all size and index values when processing sparse accessors in glTF/GLB files. Employing fuzz testing and static analysis tools can help identify similar vulnerabilities in the codebase. Additionally, sandboxing or isolating the cgltf processing component can limit the impact of crashes or memory disclosures. Restricting the acceptance of untrusted or unauthenticated 3D model files, or scanning them with security tools before processing, can reduce exposure. Logging and monitoring for unusual crashes or memory access errors related to cgltf usage can provide early detection of exploitation attempts. Finally, educating developers and security teams about this vulnerability will help ensure timely response and remediation.