Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75148— cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check

Quick assessment

Affected
jkuhlmann cgltf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

cgltf 版本 1.15 及更早版本中存在一个整数溢出漏洞，该漏洞位于 函数中对非稀疏访问器（non-sparse accessor）边界检查的处理逻辑中。攻击者通过构造恶意的访问器数量值，可导致内存泄露和拒绝服务。 具体而言，攻击者可以提供格式错误的 或 输入文件，并在其中精心构造访问器计数值，使得访问器步长（stride）与元素数量（element count）之间的无符号整数乘法发生溢出。这将导致边界检查错误地通过，进而在随后调用 处理经验证但仍为恶意的访问器时，触发堆外越界读取（heap out-of-b

CVSS 6.1 · Medium EPSS 0.15% · P5

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
jkuhlmann cgltf ≤ 1.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75148

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check
Source: CVE Program / CVE List V5
Vulnerability Description
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jkuhlmann cgltf 0 ~ 1.15 -

II. Public POCs for CVE-2026-75148

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75148

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75148 (1)

Other References for CVE-2026-75148 (1)

IV. Related Vulnerabilities

Same product: cgltf
Same vendor: jkuhlmann
Same weakness: CWE-190

V. Comments for CVE-2026-75148

No comments yet

Leave a comment