CVE-2026-71266

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71266", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:14.097Z", "dateUpdated": "2026-08-10T11:46:35.656Z"}, "containers": {"cna": {"title": "tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing", "descriptions": [{"lang": "en", "value": "tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-121", "cweId": "CWE-121", "type": "CWE"}]}], "affected": [{"vendor": "syoyo", "product": "tinyobjloader-c", "programFiles": ["tinyobj_loader_c.h"], "versions": [{"version": "0", "lessThanOrEqual": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/syoyo/tinyobjloader-c", "tags": ["third-party-advisory"]}, {"url": "https://github.com/syoyo/tinyobjloader-c/blob/master/tinyobj_loader_c.h", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:35.656Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:14.097Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:40:51.537969Z", "id": "CVE-2026-71266", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:40:58.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:40:51.537969Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:40:54.703Z"}}], "cna": {"title": "tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "syoyo", "product": "tinyobjloader-c", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "programFiles": ["tinyobj_loader_c.h"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:14.097Z", "references": [{"url": "https://github.com/syoyo/tinyobjloader-c", "tags": ["third-party-advisory"]}, {"url": "https://github.com/syoyo/tinyobjloader-c/blob/master/tinyobj_loader_c.h", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.", "supportingMedia": [{"type": "text/html", "value": "<p>tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:35.656Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71266", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:46:35.656Z", "dateReserved": "2026-08-05T12:23:34.967Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:14.097Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "tinyobjloader-c", "programFiles": ["tinyobj_loader_c.h"], "vendor": "syoyo", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file."}, {"lang": "es", "value": "La funci\u00f3n tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) de tinyobjloader-c lee cada l\u00ednea de un archivo de material .mtl en un b\u00fafer de pila fijo de 4096 bytes \u2019linebuf\u2019 a trav\u00e9s de memcpy(linebuf, p, p_len), protegida \u00fanicamente por \u2019assert(p_len menor que 4095)\u2019. Debido a que assert() se compila como una operaci\u00f3n nula (no-op) bajo -DNDEBUG (est\u00e1ndar para compilaciones de lanzamiento), un archivo .mtl manipulado que contiene una l\u00ednea (por ejemplo, un nombre de material \u2019newmtl\u2019) m\u00e1s larga de 4096 bytes desborda \u2019linebuf\u2019 hacia la variable de pila adyacente \u2019namebuf\u2019 y m\u00e1s all\u00e1, corrompiendo la pila de cualquier aplicaci\u00f3n que carga archivos de modelo/material 3D suministrados por el atacante. El patr\u00f3n vulnerable id\u00e9ntico se duplica en una segunda funci\u00f3n en el mismo archivo."}], "id": "CVE-2026-71266", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71266", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:40:51.537969Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:50.843", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/syoyo/tinyobjloader-c"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/syoyo/tinyobjloader-c/blob/master/tinyobj_loader_c.h"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tinyobjloader-c", "source": "cna", "vendor": "syoyo"}, "product": "tinyobjloader-c", "vendor": "syoyo"}], "created": "2026-08-05T15:00:05.511310+00:00", "updated": "2026-08-10T20:30:05.430565+00:00", "vendors": ["syoyo", "syoyo$PRODUCT$tinyobjloader-c"]}