The vulnerability in tinyobjloader-c arises from the function tinyobj_parse_and_index_mtl_file reading each line of a .mtl material file into a fixed 4096-byte stack buffer using memcpy(linebuf, p, p_len) without adequate boundary checks. This results in a stack-based buffer overflow (CWE-121). The same unsafe coding pattern is duplicated in another function within the same source file. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and results in high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No patch or official remediation has been disclosed yet.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code, escalate privileges, or cause denial of service. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted .mtl material files with tinyobjloader-c or apply manual code review and hardening to ensure buffer boundaries are respected. Monitor for vendor updates or patches addressing this issue.