CyberRota Analysis
AI-GeneratedThe vulnerability exists in the tinyobjloader-c library, specifically in the `tinyobj_parse_and_index_mtl_file()` function, which improperly handles input from .mtl material files by using a fixed-size stack buffer without adequate bounds checking. An attacker can exploit this flaw by crafting a malicious .mtl file with excessively long lines, leading to a stack buffer overflow that can corrupt adjacent memory and potentially execute arbitrary code. Developers and organizations utilizing this library, particularly those handling user-supplied 3D model files, should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.