tinyobjloader-c’s tinyobj_parse_and_index_mtl_file() reads each line of a .mtl material file into a 4096‑byte stack buffer linebuf via memcpy, guarded only by assert(p_len < 4095). Under release builds, assert is a no‑op, enabling an attacker to supply a line longer than 4096 bytes and overflow linebuf into adjacent namebuf and further on the stack. This stack corruption can allow an attacker to overwrite return addresses or other control data, leading to arbitrary code execution or a crash, thus providing a denial‑of‑service or exploitable execution pathway.

The vulnerability affects the syoyo tinyobjloader-c library. Any application that links against this library and loads attacker‑supplied .mtl files is potentially impacted. No specific version numbers are listed, implying all releases containing the vulnerable parsing functions are affected.

The CVSS score of 7.8 indicates a high severity, and the lack of an EPSS rating does not diminish the threat because the flaw is readily exploitable with a crafted file. The vulnerability does not appear in the CISA KEV catalog, but the stack overflow can be triggered by a local attacker who can supply input to the application. The likely attack vector is the delivery of a malicious .mtl file through ordinary user‑controlled file loading.