Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75148— cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check

Quick assessment

Affected
jkuhlmann cgltf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Johannes Kuhlmann cgltf是德国Johannes Kuhlmann个人开发者开源的一个轻量级单文件glTF模型解析组件。 Johannes Kuhlmann cgltf 1.15及之前版本存在数字错误漏洞，该漏洞源于cgltf_validate()中的非稀疏访问器边界检查存在整数溢出，可能导致远程攻击者通过提供特制的访问器数量值，使无符号整数乘法溢出，导致边界检查通过并触发堆越界读取，造成内存泄露和拒绝服务。

CVSS 6.1 · Medium EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
jkuhlmann cgltf ≤ 1.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75148

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check
Source: CVE Program / CVE List V5
Vulnerability Description
cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
Johannes Kuhlmann cgltf 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Johannes Kuhlmann cgltf是德国Johannes Kuhlmann个人开发者开源的一个轻量级单文件glTF模型解析组件。 Johannes Kuhlmann cgltf 1.15及之前版本存在数字错误漏洞，该漏洞源于cgltf_validate()中的非稀疏访问器边界检查存在整数溢出，可能导致远程攻击者通过提供特制的访问器数量值，使无符号整数乘法溢出，导致边界检查通过并触发堆越界读取，造成内存泄露和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
jkuhlmann cgltf 0 ~ 1.15 -

II. Public POCs for CVE-2026-75148

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75148

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75148 (1)

Other References for CVE-2026-75148 (1)

IV. Related Vulnerabilities

Same product: cgltf
Same vendor: jkuhlmann
Same weakness: CWE-190

V. Comments for CVE-2026-75148

No comments yet

Leave a comment