HIGH

CVE-2026-71266

2026-08-05 CVSS v3.1

CVSS

7.8

Description

tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.

Weakness (CWE)

CWE-121 Stack-based Buffer Overflow

EPSS Score

0.13%

Probability of exploitation in next 30 days

2.7th percentile

References

https://github.com/syoyo/tinyobjloader-c https://github.com/syoyo/tinyobjloader-c/blob/master/tinyobj_loader_c.h

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE