Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-112018 cgltf heap out-of-bounds write via sparse accessor indices. A crafted glTF/GLB file can corrupt heap memory, crash apps, and potentially execute code when cgltf_validate() is skipped. Affects cgltf through 1.15, fixed in 1.16. CWE-787. https://nvd.nist.gov/vuln/detail/CVE-2026-112018 #CVE #cgltf #MemoryCorruption #OutOfBoundsWrite