VULNERABILITY INTELLIGENCE
CVE-2026-75148
CVSS score6.1 MEDIUM
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-08-19
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Description
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
Weakness classification
- disclosure@vulncheck.com: CWE-190