Stack Buffer Overflow in tinyobjloader-c Affects 3D Model Processing

CVE-2026-71266

What is CVE-2026-71266?

A stack buffer overflow vulnerability exists in tinyobjloader-c when processing .mtl material files. The function tinyobj_parse_and_index_mtl_file() reads lines into a fixed-size buffer without proper length checks for the input. If a crafted .mtl file exceeds the buffer size, it can overwrite adjacent memory, leading to potential application crashes or arbitrary code execution. This issue is compounded as the assert statement, which should enforce buffer limits, is omitted in release builds. Developers must take precautions when using this library in 3D applications to mitigate exposure to this vulnerability.

References