This vulnerability occurs in the cgltf function cgltf_accessor_unpack_floats when it attempts to copy sparse accessor indices that have not been validated. The unchecked indices can cause an out‑of‑bounds write on the heap, corrupting the application’s memory space. If the library’s validation routine, cgltf_validate, is not invoked beforehand, the corruption may lead to crashes or, worse, arbitrary code execution by an attacker who supplies a specially crafted glTF or GLB file.

The affected product is the open‑source glTF parsing library cgltf maintained by jkuhlmann, up to version 1.15. Applications that embed this library to load untrusted or externally supplied glTF/GLB files are potentially impacted, regardless of the host operating system or platform.

The primary risks are memory corruption leading to crashes or potential remote code execution if the targeted application fails to perform proper validation before unpacking sparse accessor data. The CVSS score of 7.3 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so the likelihood of exploitation is not currently quantified. The impact is localized to applications using the vulnerable library and handling potentially malicious data.