CVE-2026-32845 jkuhlmann / cgltf <= 1.15 Sparse Accessor Validation Integer Overflow
Attackers can cause crashes or leak memory by providing crafted glTF files to the cgltf library due to an integer overflow in sparse accessor validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32845?
CVE-2026-32845 is a medium-severity vulnerability in jkuhlmann cgltf, published on 23 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.
Weakness: CWE-190
Which versions are affected by CVE-2026-32845?
How do I fix CVE-2026-32845?
No fix has been published for CVE-2026-32845 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32845 exists.
Sources
Also known as GHSA-5jxj-w72m-5c8f.