CVE-2026-32845: cgltf Integer Overflow DoS Vulnerability

CVE-2026-32845 Overview

CVE-2026-32845 is an integer overflow vulnerability affecting cgltf version 1.15 and earlier. The flaw exists in the cgltf_validate() function when validating sparse accessors, allowing attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Successful exploitation can lead to denial of service crashes and potential memory disclosure through heap buffer over-reads in cgltf_calc_index_bound().

Critical Impact

Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads, resulting in application crashes and potential exposure of sensitive memory contents when processing malicious 3D model files.

Affected Products

• cgltf version 1.15 and prior versions

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-32845 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32845

Vulnerability Analysis

This vulnerability stems from insufficient validation of arithmetic operations when processing sparse accessor data in glTF/GLB files. The cgltf library, a single-file glTF 2.0 parser written in C, performs size calculations during the validation phase that can overflow when processing maliciously crafted input. When the cgltf_validate() function processes sparse accessor metadata, attacker-controlled size values can cause integer overflow conditions that bypass boundary checks.

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), indicating that arithmetic operations exceed the maximum value representable by the data type, wrapping around to an unexpectedly small value. This subsequently allows the cgltf_calc_index_bound() function to read beyond allocated heap buffer boundaries.

Root Cause

The root cause lies in unchecked arithmetic operations within the sparse accessor validation logic. When calculating buffer sizes and offsets for sparse accessor elements, the code does not properly validate that multiplication and addition operations will not overflow. An attacker can craft glTF/GLB files with carefully chosen count and stride values that, when multiplied together, exceed the maximum integer value and wrap around to a small positive number. This bypasses subsequent boundary validation checks that rely on the calculated size.

Attack Vector

The attack requires local access, meaning an attacker must convince a victim to open a malicious glTF or GLB file using an application that incorporates the vulnerable cgltf library. Common attack scenarios include:

• Distributing malicious 3D model files through file-sharing platforms
• Embedding malicious glTF content in web applications that use cgltf for client-side parsing
• Exploiting automated 3D asset processing pipelines that ingest untrusted content

The exploitation mechanism involves crafting a glTF/GLB file with sparse accessor definitions containing size values that trigger the integer overflow. When the victim's application loads and validates the file, the overflow causes the parser to read beyond allocated buffer boundaries, potentially crashing the application or disclosing heap memory contents.

Detection Methods for CVE-2026-32845

Indicators of Compromise

• Application crashes when opening glTF or GLB 3D model files from untrusted sources
• Unusual memory access patterns in applications using cgltf for file parsing
• Error logs indicating heap corruption or out-of-bounds memory access during 3D file processing

Detection Strategies

• Monitor for crashes in applications that process glTF/GLB files, particularly those reporting memory access violations
• Implement file integrity checks for incoming 3D model assets before processing
• Deploy endpoint detection to identify applications loading potentially vulnerable cgltf library versions

Monitoring Recommendations

• Audit systems for applications that incorporate cgltf library versions 1.15 and earlier
• Log and alert on abnormal process terminations in 3D rendering or asset processing applications
• Monitor network traffic for downloads of glTF/GLB files from untrusted or suspicious sources

How to Mitigate CVE-2026-32845

Immediate Actions Required

• Upgrade cgltf to a patched version when available from the upstream project
• Implement input validation on glTF/GLB files before processing with cgltf
• Restrict processing of 3D model files to trusted sources only
• Consider sandboxing applications that process untrusted glTF/GLB content

Patch Information

Users should monitor the cgltf GitHub repository for patch availability. The VulnCheck Security Advisory provides additional technical details and remediation guidance. Until a patch is available, organizations should implement compensating controls to limit exposure.

Workarounds

• Validate glTF/GLB files using alternative parsers or schema validators before processing with cgltf
• Implement resource limits and sandboxing for applications processing untrusted 3D model files
• Configure file type restrictions to block glTF/GLB files from untrusted network sources
• Deploy application-level exception handling to gracefully manage parsing failures without exposing crash data