An integer overflow in the cgltf_validate() function occurs during sparse accessor validation. When attacker-controlled GLTF or GLB files contain oversized length fields, unchecked arithmetic in cgltf_calc_index_bound() can overflow the bound calculation, resulting in heap buffer over-reads. The resulting out-of-bounds reads may crash the hosting application or expose memory contents, compromising confidentiality and availability.

The vulnerability affects the cgltf library version 1.15 and earlier. Applications that link against jkuhlmann's cgltf 1.15 or older and load user‑supplied GLTF/GLB files are at risk.

The CVSS score of 6.9 indicates a medium severity vulnerability. Although the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, attackers can leverage malicious model files that the application imports. The attack vector is inferred from the description as a local or remote file‑submission attack where the attacker supplies a crafted GLTF file to trigger the overflow. Exploitation requires that the target application use the vulnerable library without protecting against oversized sparse accessor sizes.