Threat Intelligence Database

An integer overflow vulnerability exists in cgltf through version 1.15 in the non-sparse accessor bounds check within the cgltf_validate() function. This flaw allows remote attackers to supply specially crafted .gltf or .glb files with malformed accessor count values that cause an unsigned integer multiplication overflow. The overflow bypasses bounds checking and leads to a heap out-of-bounds read when cgltf_accessor_read_float() is called, potentially resulting in memory disclosure and denial of service.

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.