Executive brief
tinyobjloader is a software library used by developers to load 3D model files (OBJ format) into applications and games. A security flaw in its experimental material file loader allows a specially crafted file to crash the application. This could be used by an attacker to cause a denial-of-service, preventing the software from functioning correctly when it attempts to process the malicious 3D asset.
Technical details
A stack-based buffer overflow exists in the `tinyobj_opt::LoadMtl` function within the `experimental/tinyobj_loader_opt.h` header of tinyobjloader. The vulnerability is caused by the use of `sscanf` with a `%s` format specifier to read a `newmtl` token into a fixed-size local buffer (`namebuf`) without bounds checking. An attacker can exploit this by providing a crafted `.mtl` file containing an oversized material name, leading to a stack overflow and application crash. A fix was introduced in commit 386b73b by implementing a width limit in the `sscanf` format string.
Affected products
- tinyobjloader tinyobjloader up to commit d56555b
Timeline
- 2026-04-13: advisory: CVE-2026-29628 published by MITRE/NVD
- 2026-04-13: patched: Fix proposed in commit 386b73bb8c1a855236beb73b11f45f7feac4e03a