Threat database

Tinyexr versions up to 3.2.0 have a heap out-of-bounds read vulnerability in the function ParseEXRMultipartHeaderFromMemory(). This flaw allows attackers to craft multi-part EXR files that bypass bounds checks, potentially causing application crashes or leaking adjacent heap memory. The vulnerability arises from a stale remaining-size value leading to reading beyond buffer limits.

tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.