CVE-2026-75148
Received Received - Intake

Integer Overflow in cgltf Library

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75148
EUVD
EUVD-2026-62431

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cgltf cgltf to 1.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the cgltf library version 1.15 and earlier. It occurs in the cgltf_validate() function during bounds checking of non-sparse accessors. Attackers can exploit this by providing malformed .gltf or .glb files with crafted accessor count values that cause an unsigned integer overflow when multiplying accessor stride and element count. This overflow bypasses the bounds check, allowing a heap out-of-bounds read later when cgltf_accessor_read_float() processes the invalid accessor.

Detection Guidance

This vulnerability is specific to applications using the cgltf library version 1.15 or earlier. To detect it, check if any applications on your system use cgltf by inspecting installed software or dependencies. Look for glTF or GLB file processing capabilities in applications. No direct network detection commands are applicable as this is a library-level issue.

Impact Analysis

This vulnerability can lead to memory disclosure and denial of service. An attacker could exploit it to read sensitive memory outside the intended buffer, potentially exposing confidential data. It may also crash the application by causing invalid memory access, disrupting normal operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to memory disclosure and denial of service in the cgltf library. However, if exploited, it could lead to unauthorized data access or system disruptions, which may indirectly impact compliance by compromising data integrity or availability.

Mitigation Strategies

Immediately update the cgltf library to the latest version that fixes the integer overflow issue. If updating is not possible, consider disabling or removing any applications that use cgltf version 1.15 or earlier. Validate all glTF or GLB files before processing them with affected software to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart