---
id: "CVE-2026-112019"
kind: "vulnerability"
aliases: ["CVE-2026-112019"]
title: "cgltf: crafted glTF file reads adjacent heap memory during parsing"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["3d-graphics", "c", "game-engines", "gltf", "package"]
not_affected_if: ["trusted-assets-only"]
published_at: "2026-10-18T12:17:14+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:41:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112019", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# cgltf: crafted glTF file reads adjacent heap memory during parsing

cgltf, a single-header C library for loading glTF and GLB 3D models, has a heap out-of-bounds read in cgltf_accessor_unpack_floats() when sparse accessor values are advanced by the base bufferView stride. A crafted file that passes cgltf_validate() can leak adjacent heap memory into vertex data or crash the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project vendors or links cgltf, for example with `grep -ri cgltf` over the source tree or the lockfile.
- Confirm the version in use; the sources say flaws exist through `1.15`, and no fixed version is named.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112019

## From the sources

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_