A stack overflow in tinyobjloader’s experimental/tinyobj_loader_opt.h file allows a crafted .mtl file to overflow the stack during parsing. The overflow causes the application using the library to crash, resulting in a denial‑of‑service condition. The flaw is a classic stack-based buffer overflow, categorized as CWE‑121.

The vulnerable code exists in the experimental/tinyobj_loader_opt.h header of the tinyobjloader library in commit d56555b. Any software that compiles this header or uses the experimental optimized loader can be impacted. Vendor and product information is not provided by the CNA, so the vulnerability may affect any custom or third‑party applications that ship with this library. No specific version numbers are listed, but the issue exists in all builds that contain the problematic code before the patch.

The CVSS score of 6.2 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred: an attacker supplies a maliciously crafted .mtl file to the victim application, which then passes it to tinyobjloader, causing a crash. This vector does not require authentication and results only in service disruption, not code execution or data compromise.