kiyochii/cve-2026-29628Proof-of-concept for CVE-2026-29628, a stack-based buffer overflow in tinyobjloader's experimental parser, with ASan/UBSan reproduction and fix reference.
Stack-based buffer overflow overflow in https://github.com/tinyobjloader/tinyobjloader, it only affects the experimental version, which can lead to unexpected results.
tinyobjloader is affected in all versions up to commit d56555b.
A fix was proposed in:
386b73bb8c1a855236beb73b11f45f7feac4e03aRepository:
The issue is reproducible under AddressSanitizer as a stack-buffer-overflow in , where an oversized is written into the fixed-size local buffer .
tinyobj_opt::LoadMtlnewmtl tokennamebufBuild the proof of concept with AddressSanitizer and UndefinedBehaviorSanitizer enabled:
clang++ -std=c++17 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer \
-I./tinyobjloader \
-I./tinyobjloader/experimental \
poc.cpp -o poc