CVE-2026-75148 jkuhlmann CVE debrief

Who should care

Defenders responsible for systems utilizing cgltf, especially those handling .gltf or .glb files, should assess exposure and prioritize remediation efforts. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also verify affected versions and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-75148 because it allows remote attackers to cause denial of service and memory disclosure in cgltf. Systems handling .gltf or .glb files are at risk. Verification of affected versions and remediation efforts are necessary.

• Denial of service through crafted .gltf or .glb input
• Memory disclosure due to heap out-of-bounds read

Technical summary

The cgltf library through version 1.15 is vulnerable to an integer overflow in the non-sparse accessor bounds check within cgltf_validate(). This allows remote attackers to cause memory disclosure and denial of service by providing crafted accessor count values in .gltf or .glb files. The vulnerability can be triggered by providing malformed input to overflow the unsigned integer multiplication of accessor stride and element count. This causes the bounds check to pass and triggers a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor.

Defensive priority

Defenders should prioritize verification of affected versions and remediation efforts for systems utilizing cgltf, especially those handling .gltf or .glb files.

Recommended defensive actions

• Verify cgltf version and assess exposure
• Review systems handling .gltf or .glb files for potential vulnerability
• Monitor for and apply patches or updates for cgltf
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the integer overflow vulnerability in cgltf. However, specific affected versions and detailed exploitation scenarios require further verification. The vulnerability allows remote attackers to cause denial of service and memory disclosure. Systems handling .gltf or .glb files are at risk. Verification of affected versions and remediation efforts are necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.