{"id":"CVE-2026-71266","aliases":["EUVD-2026-53351","GHSA-gr59-p4q8-r75g","UBUNTU-CVE-2026-71266"],"status":"published","title":"tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00174,"percentile":0.06886,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2026-08-05T12:26:14Z","modified":"2026-10-24T15:10:00Z","affected":[{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.1-2","0.7.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1-1","0.8.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.6-3","0.10.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-1.1","0.11.0-1.1build2","0.11.0-1.1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-1.1build4","0.15.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"raylib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0+ds-1","6.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"goxel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-1.1build3","0.11.0-1.1build4"]}],"products":[{"vendor":"syoyo","product":"tinyobjloader-c"}],"references":[{"url":"https://github.com/syoyo/tinyobjloader-c","tags":["third-party-advisory","report"]},{"url":"https://github.com/syoyo/tinyobjloader-c/blob/master/tinyobj_loader_c.h","tags":["third-party-advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71266"},{"url":"https://github.com/advisories/GHSA-gr59-p4q8-r75g"},{"url":"https://ubuntu.com/security/CVE-2026-71266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71266","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71266","title":"tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.","status":"published","published":"2026-08-05T12:26:14.097Z","modified":"2026-08-10T11:46:35.656Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53351","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.","status":"published","published":"2026-08-05T12:26:14Z","modified":"2026-08-10T11:46:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-gr59-p4q8-r75g","title":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) reads each line of a ...","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer `linebuf` via memcpy(linebuf, p, p_len), guarded only by `assert(p_len \u003c 4095)`. Because assert() compiles to a no-op under -DNDEBUG (standard for release builds), a crafted .mtl file containing a line (e.g. a \"newmtl\" material name) longer than 4096 bytes overflows linebuf into the adjacent stack variable namebuf and beyond, corrupting the stack of any application that loads attacker-supplied 3D model/material files. The identical vulnerable pattern is duplicated in a second function in the same file.","status":"published","published":"2026-08-05T15:32:19Z","modified":"2026-08-05T15:32:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:10:07.328501Z"}],"nvd":[{"id":"CVE-2026-71266","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.","status":"published","published":"2026-08-05T13:24:50.843Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"UBUNTU-CVE-2026-71266","description":"tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.","status":"published","published":"2026-08-05T13:24:00Z","modified":"2026-10-17T13:00:46.103063943Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:03.035847Z"}]}}