The vulnerability is a heap out‑of‑bounds read in the cgltf_accessor_unpack_floats() function. A crafted glTF or GLB file that passes basic validation can cause the library to read memory beyond the intended buffer. The arbitrary data is copied into vertex buffers, giving an attacker the ability to disclose sensitive data stored adjacent on the heap, or to crash the application. This flaw is an example of CWE‑125 and affects the confidentiality and availability of the host process.

The flaw is present in jkuhlmann’s cgltf library up to and including version 1.15. Any application that links against cgltf 1.15 or earlier and processes user‑supplied glTF/GLB files is affected. No other vendors or products are listed as impacted.

The CVSS score for this vulnerability is 6.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must supply a specially crafted GLTF or GLB file that passes the library’s initial validation; the trigger occurs at unpacking time. Because the flaw only allows read of adjacent heap memory and not execution, the risk is limited to data disclosure or application crash, but still poses a significant threat if the library is exposed to untrusted input.