CVE-2020-28589

2021-08-1113:15:15

Google

osv.dev

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

65.0%

JSON

An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CPENameOperatorVersion
tinyobjloadereq0.9.25
tinyobjloadereq1.0.0
tinyobjloadereq1.0.2
tinyobjloadereq1.0.4
tinyobjloadereq0.9.20
tinyobjloadereq0.9.18
tinyobjloadereq1.0.6
tinyobjloadereq0.9.23
tinyobjloadereq1.0.1
tinyobjloadereq0.9.24

Name	Operator	Version
tinyobjloader	eq	0.9.25
tinyobjloader	eq	1.0.0
tinyobjloader	eq	1.0.2
tinyobjloader	eq	1.0.4
tinyobjloader	eq	0.9.20
tinyobjloader	eq	0.9.18
tinyobjloader	eq	1.0.6
tinyobjloader	eq	0.9.23
tinyobjloader	eq	1.0.1
tinyobjloader	eq	0.9.24