The vulnerability in tinyobjloader-c arises from the function tinyobj_parse_and_index_mtl_file() in tinyobj_loader_c.h, which reads each line of a .mtl material file into a fixed-size 4096-byte stack buffer named linebuf using memcpy. The length check is performed using assert(p_len < 4095), which is compiled out in release builds with -DNDEBUG, effectively removing the protection. Consequently, a maliciously crafted .mtl file containing a line exceeding 4096 bytes can overflow linebuf, corrupting adjacent stack variables such as namebuf and potentially leading to arbitrary code execution or application crashes. An identical vulnerable code pattern exists in a second function within the same source file, compounding the risk. The CVSS v3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability with local attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation of this vulnerability can lead to stack corruption, which may result in arbitrary code execution, application crashes, or denial of service when processing attacker-controlled 3D model or material files. The vulnerability affects any application using tinyobjloader-c to load .mtl files, potentially compromising the security of the host system. The CVSS score of 7.8 indicates a high severity impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading untrusted or unauthenticated .mtl files with tinyobjloader-c. Developers should consider auditing and modifying the code to replace assert-based length checks with proper runtime validation to prevent buffer overflows.