CVE-2026-71266
7.8 HIGHpublic exploit availablePublished 2026-08-05 · Updated 2026-08-10
AI risk analysis
- Summary
- The flaw involves a fixed-size stack buffer in tinyobjloader-c's parsing function, allowing potential overflow if input exceeds 4096 bytes.
- Exploitability
- Exploitation requires crafting a .mtl file with maliciously large content; practicality depends on the target environment and network access.
- Blast radius
- If exploited, could lead to remote code execution or denial of service affecting applications using tinyobjloader-c for material file parsing.
- Prioritized remediation
- Update to a patched version of tinyobjloader-c or apply buffer size adjustments in the vulnerable functions.
rcebuffer-overflowparsingsecurity
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-121
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.