cgltf, a lightweight GLTF loader, contains an integer overflow in the non‑sparse accessor bounds check inside cgltf_validate(). An attacker can supply a .gltf or .glb file with a crafted accessor count that causes the multiplication of the accessor stride and element count to overflow an unsigned integer. The bounds check incorrectly succeeds and later cgltf_accessor_read_float() performs a heap out‑of‑bounds read on the malformed accessor, potentially exposing sensitive memory contents and allowing the attacker to crash the application, resulting in denial of service.

The vulnerable library is cgltf, maintained by jkuhlmann. All releases up to and including version 1.15 contain the flaw. Any application that incorporates those versions of cgltf and accepts externally supplied .gltf or .glb files is potentially affected. No other vendors or products are listed as affected.

The CVSS score is 6.9, indicating moderate risk. EPSS is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by providing a malicious 3D file to an application that loads GLTF assets.