CVE-2026-75148 Overview
CVE-2026-75148 is an integer overflow vulnerability [CWE-190] in cgltf, a single-file C/C++ loader for the glTF 2.0 3D asset format. The flaw resides in the non-sparse accessor bounds check inside cgltf_validate(). Attackers can craft .gltf or .glb files with accessor count values that overflow the unsigned integer multiplication of accessor stride and element count. When the overflow occurs, the bounds check incorrectly passes and later triggers a heap out-of-bounds read in cgltf_accessor_read_float(). Exploitation can disclose adjacent heap memory or crash the host application. Affected versions include cgltf through 1.15.
Critical Impact
Processing a malicious 3D asset with a vulnerable cgltf build results in heap out-of-bounds reads, leading to memory disclosure and denial of service in any application that embeds the library.
Affected Products
- cgltf versions through 1.15
- Applications and game engines statically linking cgltf for glTF/GLB parsing
- Downstream tools relying on cgltf_validate() prior to accessor reads
Discovery Timeline
- 2026-08-19 - CVE-2026-75148 published to the National Vulnerability Database (NVD)
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75148
Vulnerability Analysis
The cgltf library validates accessor descriptors before consumers read numeric data from them. The cgltf_validate() function checks whether an accessor's element region fits inside its bound buffer view. That check computes the byte range as the product of the accessor stride and the accessor count. Both operands are unsigned integers of fixed width. A crafted count value forces the multiplication to wrap around modulo 2^N and produce a small result. The wrapped result compares as smaller than the buffer view size, so validation returns success on a malformed accessor.
Once validation passes, callers assume the accessor is safe to read. cgltf_accessor_read_float() then indexes past the end of the underlying buffer. The resulting out-of-bounds read yields uninitialized or adjacent heap contents to the caller. Under fuzzing conditions, the read commonly triggers a crash, producing denial of service in host processes.
Root Cause
The root cause is missing overflow detection during the size computation in the non-sparse accessor branch of cgltf_validate(). The check trusts arithmetic on attacker-controlled fields without saturating or performing a checked multiplication. See GitHub Issue #301 for the maintainer discussion and the VulnCheck Advisory on cgltf for the coordinated write-up.
Attack Vector
Exploitation requires an attacker to deliver a crafted .gltf or .glb file to a user or automated pipeline that parses the asset with a vulnerable cgltf build. User interaction is required to open or import the file. The primary outcomes are heap memory disclosure and process termination. Exploitation code is not publicly available at the time of publication.
See the VulnCheck Advisory on cgltf for technical reproduction details.
Detection Methods for CVE-2026-75148
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes that load glTF or GLB assets.
- Heap sanitizer reports (ASan) referencing cgltf_accessor_read_float on adjacent regions of a buffer view.
- Inbound .gltf or .glb files whose JSON contains accessor count values near UINT32_MAX or otherwise inconsistent with the referenced bufferView byte length.
Detection Strategies
- Statically scan build artifacts and vendored source trees for cgltf.h at versions 1.15 or earlier.
- Add a pre-parse validator that rejects glTF assets when stride * count exceeds the buffer view size using checked arithmetic.
- Instrument asset pipelines with AddressSanitizer during CI to catch out-of-bounds reads on new test corpora.
Monitoring Recommendations
- Monitor crash telemetry from applications that import 3D content, correlating crashing frames to cgltf symbols.
- Log and alert on glTF assets rejected by content filters, retaining samples for reverse engineering.
- Track third-party dependency inventories (SBOMs) for cgltf and flag any component still pinned to affected releases.
How to Mitigate CVE-2026-75148
Immediate Actions Required
- Inventory all applications, engines, and tools that embed cgltf and identify the exact version in use.
- Update cgltf to the fixed revision published in the upstream repository once available, or apply the patch referenced in GitHub Issue #301.
- Treat glTF and GLB files from untrusted sources as untrusted input and route them through a sandboxed parser.
Patch Information
Refer to the upstream project at GitHub Issue #301 for the fix status and commit that adds overflow-safe bounds checking to cgltf_validate(). Rebuild and redeploy all downstream binaries after replacing the header. The VulnCheck Advisory on cgltf provides additional remediation guidance.
Workarounds
- Pre-validate incoming glTF assets with a wrapper that performs count <= (buffer_view_size / stride) using unsigned division before invoking cgltf.
- Restrict asset ingestion to trusted sources and enforce authenticated signing on 3D content pipelines.
- Run parsing components as low-privilege, sandboxed processes so that a successful out-of-bounds read cannot access sensitive process memory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
