Description
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jkuhlmann cgltf
Default version status: unaffected
0 to ≤ 1.15affected
pkg:github/jkuhlmann/cgltfReferences
- https://hackmd.io/@haindpwn/cgltf-accessor-unpack-floats-sparse-oob ↗
- https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102ae9c69b27c5d101167ff5ba/cgltf.h#L2436-L2441 ↗
- https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102ae9c69b27c5d101167ff5ba/cgltf.h#L1612-L1619 ↗
- https://github.com/jkuhlmann/cgltf ↗
- https://www.vulncheck.com/advisories/cgltf-through-1.15-heap-out-of-bounds-read-via-cgltf-accessor-unpack-floats ↗