CVE-2026-112018: Heap Out-of-Bounds Write in cgltf Affects 3D Asset Processing

• •CVE-2026-112018 is a heap out-of-bounds write vulnerability in cgltf up to version 1.15.
• •Attackers can exploit this flaw via crafted glTF or GLB files, potentially leading to crashes or code execution.
• •Remediation includes upgrading to a fixed release and validating untrusted 3D assets before processing.

A heap out-of-bounds write vulnerability (CVE-2026-112018) has been identified in cgltf versions up to 1.15, specifically in the function cgltf_accessor_unpack_floats(). This flaw allows attackers to craft glTF or GLB files with large sparse indices, potentially leading to application crashes or arbitrary code execution if validation functions are bypassed. The vulnerability affects applications that process untrusted 3D assets, particularly those embedding native glTF parsing in game engines and 3D viewers. The exploit requires user interaction to trigger the parsing path, and the current exploitation status remains uncertain. No proof-of-concept (PoC) or active exploitation has been confirmed yet, but remediation is strongly advised. Users are encouraged to upgrade to a fixed release and implement validation checks before unpacking assets.