CVE-2026-29628

EUVD-2026-21926
A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (DoS) via supplying a crafted .mtl file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.73%
Debian logo
Debian Releases
Debian Product
Codename
tinyobjloader
bookworm
2.0.0~rc10+dfsg-2
fixed
bullseye
2.0.0~rc5+dfsg1-4
fixed
forky
2.0.0~rc13+dfsg-3
fixed
sid
2.0.0~rc13+dfsg-3
fixed
trixie
2.0.0~rc13+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tinyobjloader
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/kiyochii/CVE-2026-29628
https://github.com/kiyochii/tinyobjloader/commit/386b73bb8c1a855236beb73b11f45f7feac4e03a