Heap Out-of-Bounds Write in cgltf Library

Executive Summary

This is a heap out-of-bounds write vulnerability in the cgltf library version 1.15 and earlier. It occurs in the function cgltf_accessor_unpack_floats() when processing sparse accessor indices in glTF or GLB files. Attackers can craft malicious files with large sparse indices to write data outside the intended output buffer, corrupting heap memory, causing crashes, or potentially executing arbitrary code if input validation is skipped.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect glTF/GLB files processed by cgltf for large sparse indices or malformed buffer views. Use tools like file inspection utilities to check file integrity. Monitor applications using cgltf for crashes or memory corruption when parsing 3D assets. Validate files with cgltf_validate() if available.

Useful 0 Not Useful 0

Impact Analysis

If you use applications that rely on cgltf to parse glTF or GLB files, this vulnerability could allow attackers to crash your software, corrupt memory, or execute malicious code by tricking you into opening a specially crafted 3D model file. The impact depends on whether the application calls cgltf_validate() to check input files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution or data corruption through crafted glTF files. If exploited, it may lead to unauthorized access, data breaches, or integrity violations, which are critical concerns under these regulations. The lack of validation in cgltf_validate() exacerbates this risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update cgltf to the latest patched version. If updating is not possible, ensure cgltf_validate() is called before processing files. Avoid parsing untrusted glTF/GLB files. Implement input validation for sparse indices and buffer views. Monitor for crashes or memory corruption in applications handling 3D assets.

Useful 0 Not Useful 0