{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cgltf--1.15/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cgltf_project:cgltf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-112018"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cgltf (\u003c= 1.15)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe cgltf library, a lightweight glTF 2.0 loader, contains a heap out-of-bounds write vulnerability in versions up to and including 1.15. The issue resides within the cgltf_accessor_unpack_floats() function. An attacker can exploit this by providing a specially crafted glTF or GLB file containing unchecked sparse accessor indices. When parsed by an application using the vulnerable cgltf library, these large indices cause the loader to write data outside the intended output buffer, corrupting heap memory. This can result in an immediate application crash (DoS) or, in certain memory layouts, allow an attacker to gain control over application execution flow. The risk is particularly elevated in applications that fail to call the cgltf_validate() function before processing the data, as the library does not inherently enforce strict bounds checking on these indices.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to a denial of service through application crashes or arbitrary code execution within the context of the vulnerable host process. Given that cgltf is a common component in 3D rendering engines, game engines, and graphics processing tools, the potential attack surface includes any software that processes untrusted 3D assets, such as web browsers, 3D model viewers, and game assets pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate any software utilizing the cgltf library to version 1.16 or later, where the input validation for sparse accessor indices has been improved.\u003c/li\u003e\n\u003cli\u003eReview all integrations of the cgltf library to ensure the mandatory execution of cgltf_validate() on all untrusted input files before they reach the unpacking or processing stage.\u003c/li\u003e\n\u003cli\u003eAudit custom parsers that incorporate cgltf code for the absence of pre-processing validation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T12:22:03Z","date_published":"2026-10-18T12:22:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cgltf-heap-corruption/","summary":"The cgltf library through version 1.15 is susceptible to a heap out-of-bounds write vulnerability via maliciously crafted glTF or GLB files, potentially leading to arbitrary code execution.","title":"Heap Out-of-Bounds Write Vulnerability in cgltf","url":"https://feed.craftedsignal.io/briefs/2026-10-cgltf-heap-corruption/"}],"language":"en","title":"CraftedSignal Threat Feed - Cgltf (\u003c= 1.15)","version":"https://jsonfeed.org/version/1.1"}