SUSE CVE-2026-71266

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

CVE-2026-71266

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

UBUNTU-CVE-2026-71266

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

EUVD-2026-53351

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer linebuf via memcpylinebuf, p, plen, guarded only by assertplen 4095. Because assert compiles to a no-op under -DNDEBUG standard for release builds, a crafted...

CVE-2026-71266

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

CVE-2026-71266 tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

PT-2026-68139

Name of the Vulnerable Software and Affected Versions tinyobjloader-c affected versions not specified Description The tinyobj parse and index mtl file function in tinyobj loader c.h reads lines from a .mtl material file into a fixed 4096-byte stack buffer linebuf using memcpylinebuf, p, p len. Th...

SUSE CVE-2026-29628

A stack overflow in the experimental/tinyobjloaderopt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service DoS via supplying a crafted .mtl file...

CVE-2026-29628

A flaw was found in tinyobjloader. A stack overflow vulnerability exists in the experimental/tinyobjloaderopt.h file. A remote attacker could exploit this by supplying a specially crafted .mtl file. This could lead to a Denial of Service DoS, making the application unavailable...

EUVD-2026-21926

A stack overflow in the experimental/tinyobjloaderopt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service DoS via supplying a crafted .mtl file...

CVE-2026-29628

A stack overflow in the experimental/tinyobjloaderopt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service DoS via supplying a crafted .mtl file...

CVE-2026-29628

A stack overflow in the experimental/tinyobjloaderopt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service DoS via supplying a crafted .mtl file...

CVE-2026-29628

A stack overflow exists in the experimental/tinyobj_loader_opt.h file of the tinyobjloader library (specifically affecting versions up to commit d56555b). The vulnerability is triggered when processing a crafted .mtl file , where an oversized input is written into a fixed-size local buffer, poten...

CVE-2026-29628

A stack overflow in the experimental/tinyobjloaderopt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service DoS via supplying a crafted .mtl file...

CVE-2025-14802 LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/fileid REST API endpoint. This is due to a parameter mismatch between the DELETE operation and authorization check, where the...

CVE-2025-14802: Authorization Bypass Through User-Controlled Key

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/fileid REST API endpoint. This is due to a parameter mismatch between the DELETE operation and authorization check, where the...