CVE-2026-32845 Details

A vulnerability exists in cgltf versions through 1.15, where an integer overflow occurs in the cgltf_validate() function during the validation of sparse accessors. This flaw allows attackers to manipulate size values in crafted glTF/GLB files, triggering out-of-bounds reads. The unchecked arithmetic in sparse accessor validation can cause heap buffer over-reads in cgltf_calc_index_bound(), leading to denial-of-service crashes and potential memory disclosure.

Users are advised to update to cgltf version 1.16 or later, where this vulnerability has been addressed.