CVE-2026-112019 Details

A heap out-of-bounds read vulnerability has been identified in the cgltf library, specifically in the function cgltf_accessor_unpack_floats. This vulnerability exists in versions through 1.15 and allows attackers to exploit sparse accessors in glTF or GLB files. When such a file is parsed, the vulnerability can be triggered by crafting an accessor that takes advantage of the way sparse values are handled. The issue arises because the function advances the cursor for sparse values based on the accessor's byteStride, which can lead to reading adjacent heap memory into vertex data or causing applications to crash. Notably, this vulnerability can be exploited even if the glTF file passes validation checks.

To address this vulnerability, the cgltf library should be updated to version 1.15 or later, where the issue has been fixed. Users can also apply the recommended changes manually by modifying the cgltf_accessor_unpack_floats function to include proper bounds checks and adjust how the sparse values cursor is advanced.