tinyobjloader‑c’s tinyobj_parse_and_index_mtl_file reads each line of a .mtl material file into a fixed 4096‑byte stack buffer via memcpy, without performing explicit bounds checking; the code only references a guard that is not enforced in release builds. This permits an attacker to supply a line longer than 4096 bytes and overflow the buffer, potentially corrupting adjacent stack data such as the name buffer and other control structures. Such stack corruption can lead to return address overwrite or other control‑flow hijack, allowing arbitrary code execution or, at minimum, a denial of service. The vulnerability is present in both parsing functions in the same file.

The vulnerability affects the syoyo tinyobjloader‑c library. Any application that links against this library and loads attacker‑supplied .mtl files is potentially impacted. No specific version numbers are listed, implying all releases containing the vulnerable parsing functions are affected.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1% does not diminish the threat because the flaw is readily exploitable with a crafted file. The vulnerability does not appear in the CISA KEV catalog, but the stack overflow can be triggered by a local attacker who can supply input to the application. The likely attack vector is the delivery of a malicious .mtl file through ordinary user‑controlled file loading.