Cgltf (<= 1.15) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cgltf--1.15/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 18 Oct 2026 12:22:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHeap Out-of-Bounds Write Vulnerability in cgltfhttps://feed.craftedsignal.io/briefs/2026-10-cgltf-heap-corruption/Sun, 18 Oct 2026 12:22:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cgltf-heap-corruption/The cgltf library through version 1.15 is susceptible to a heap out-of-bounds write vulnerability via maliciously crafted glTF or GLB files, potentially leading to arbitrary code execution.The cgltf library, a lightweight glTF 2.0 loader, contains a heap out-of-bounds write vulnerability in versions up to and including 1.15. The issue resides within the cgltf_accessor_unpack_floats() function. An attacker can exploit this by providing a specially crafted glTF or GLB file containing unchecked sparse accessor indices. When parsed by an application using the vulnerable cgltf library, these large indices cause the loader to write data outside the intended output buffer, corrupting heap memory. This can result in an immediate application crash (DoS) or, in certain memory layouts, allow an attacker to gain control over application execution flow. The risk is particularly elevated in applications that fail to call the cgltf_validate() function before processing the data, as the library does not inherently enforce strict bounds checking on these indices.

Impact

Successful exploitation can lead to a denial of service through application crashes or arbitrary code execution within the context of the vulnerable host process. Given that cgltf is a common component in 3D rendering engines, game engines, and graphics processing tools, the potential attack surface includes any software that processes untrusted 3D assets, such as web browsers, 3D model viewers, and game assets pipelines.

Recommendation

Prioritized actions for development and security engineering teams:

  • Update any software utilizing the cgltf library to version 1.16 or later, where the input validation for sparse accessor indices has been improved.
  • Review all integrations of the cgltf library to ensure the mandatory execution of cgltf_validate() on all untrusted input files before they reach the unpacking or processing stage.
  • Audit custom parsers that incorporate cgltf code for the absence of pre-processing validation.
]]>highadvisoryvulnerabilitymemory-corruption