CVE-2026-71266
Received Received - Intake

Stack Buffer Overflow in tinyobjloader-c MTL Parser

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
tinyobjloader-c's tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer `linebuf` via memcpy(linebuf, p, p_len), guarded only by `assert(p_len < 4095)`. Because assert() compiles to a no-op under -DNDEBUG (standard for release builds), a crafted .mtl file containing a line (e.g. a "newmtl" material name) longer than 4096 bytes overflows linebuf into the adjacent stack variable namebuf and beyond, corrupting the stack of any application that loads attacker-supplied 3D model/material files. The identical vulnerable pattern is duplicated in a second function in the same file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71266
EUVD
EUVD-2026-53351

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tinyobjloader tinyobj_loader_c *
syoyo tinyobjloader-c to 2026-06-19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in tinyobjloader-c's material file parser. It occurs when a .mtl file contains a line longer than 4096 bytes, which overflows a fixed-size buffer and corrupts adjacent stack memory. The issue arises because the length check uses an assert() that becomes inactive in release builds (-DNDEBUG), allowing the overflow to occur undetected.

Detection Guidance

To detect this vulnerability, inspect applications using tinyobjloader-c for loading .obj or .mtl files. Check if they process untrusted 3D model files. Use static analysis tools to find buffer overflows in functions like tinyobj_parse_and_index_mtl_file(). Monitor for crashes or memory corruption when parsing large material names.

Impact Analysis

An attacker could exploit this by providing a maliciously crafted 3D model or material file. This could lead to arbitrary code execution, denial-of-service, or data corruption in any application using the vulnerable library to load 3D files. The impact depends on the privileges of the application processing the file.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches if exploited, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations using affected applications may face compliance violations if the vulnerability is exploited to access sensitive data.

Mitigation Strategies

Immediately stop using tinyobjloader-c or upgrade to a patched version if available. If upgrading is not possible, implement strict input validation to reject .mtl files with material names longer than 4095 bytes. Disable assertions in release builds (-DNDEBUG) to enforce buffer checks. Use sandboxing or file validation tools to prevent processing malicious files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart