CVE Alert: CVE-2026-112018 – jkuhlmann

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

**Risk verdict:** Prioritise remediation for software that processes untrusted 3D assets; exploitation status and prevalence cannot be established from the supplied data.

**Why this matters:** A successful attack could compromise the application’s process, with potential loss of data confidentiality, integrity and availability. Realistic outcomes include crashing asset-processing services or gaining code execution in the context of a user-facing application. KEV, SSVC, PoC and EPSS indicators were not provided, so active exploitation and likelihood at scale remain uncertain.

**Most likely attack path:** An attacker supplies a crafted asset that a user or service opens or imports. The attack requires the vulnerable parsing path to be reached, but no prior privileges are indicated; user interaction is required, and the CVSS v3 scope is unchanged, so direct lateral movement is not established.

**Who is most exposed:** Teams embedding native glTF parsing in game engines, 3D viewers, content pipelines, asset converters or applications that accept files from external users are most exposed.

Alert on crashes or memory-safety faults during asset import.

Review logs for unexpected uploads or imports of untrusted 3D files.

Triage suspicious files alongside endpoint and service crash telemetry.

Mitigation and prioritisation

Upgrade to a maintainer-fixed release; confirm the fix before deployment.

Until patched, block untrusted assets or process them in isolated, low-privilege environments.

Add validation before unpacking and test with malformed-file cases.

Roll out through normal change control, prioritising internet-facing and externally supplied asset workflows.

If KEV is confirmed or EPSS is ≥0.5, treat as priority 1.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.