CVE-2026-112018 is a high severity (CVSS 7.0) heap out-of-bounds write in cgltf through 1.15. A crafted glTF or GLB file with large sparse indices can corrupt memory in cgltf_accessor_unpack_floats. The record names no fixed version. The sections below cover affected versions, how to check, and what to do first.
What's affected
cgltf through 1.15, per the record and VulnCheck. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
cgltf is a single file glTF loader, so it is copied into projects rather than installed. Your product may embed an affected copy without listing it. The record says the risk is higher when cgltf_validate is not called on the loaded data.
Scoring note: the record's 7.0 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.3 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Search your source tree and vendored code for the affected function:
grep -rn "cgltf_accessor_unpack_floats" .
Check the version comment in your copy of cgltf.h and compare it with upstream. Also check whether your code calls cgltf_validate after parsing, as the record says that matters.
If your software loads glTF files from users or the network, it can be reached. If it only loads files you ship, the exposure is lower.
What to do now
- Find every copy of cgltf.h in your projects and dependencies.
- Call cgltf_validate on loaded data before using accessors.
- Check the project's repository for a commit that adds bounds checks on sparse indices, then update your copy.
- Do not load untrusted glTF files in privileged processes.
- Rebuild and redeploy everything that embeds the header.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-787, an out-of-bounds write. A sparse accessor stores only some values plus the indices where they go. The unpacking code trusted those indices and wrote to the output buffer without checking they were inside it.
The vector rates the attack as local with user interaction, since a victim must open a hostile file. File parsers are a steady source of memory bugs because the input is shaped by the attacker. Vendored single header libraries are also easy to miss in dependency scans. It is not listed in CISA KEV.
Quick check
Why is cgltf hard to track?
It ships as a single header copied into source trees, so package manifests may not list it.
Does calling the validate function fix it?
The record says the risk applies when validation is not called, but check the project for the fix itself.
Sources
Last reviewed: 18 October 2026.
