CVE-2026-29628

CVE-2026-29628 is a stack overflow vulnerability in the tinyobjloader library, specifically within the experimental/tinyobj_loader_opt.h file at commit d56555b. This flaw allows attackers to trigger a Denial of Service condition by supplying a maliciously crafted .mtl (material) file to affected applications using this library. The vulnerability impacts any software that integrates the vulnerable version of tinyobjloader and processes untrusted 3D model material files. The vulnerability carries a CVSS 3.1 score of 6.2 (Medium severity) with a local attack vector requiring no special privileges or user interaction. While the attack complexity is low, the impact is limited to availability disruption, with no potential for confidentiality or integrity compromise. The low EPSS score of 0.000170000 suggests minimal real-world exploitation prevalence compared to other disclosed vulnerabilities. There is currently no evidence of active exploitation in the wild, as indicated by the inactive status on the KEV catalog and absence from threat intelligence tracking lists. No public exploit code has been widely disseminated, and community attention remains minimal. Organizations using tinyobjloader should prioritize patching only if processing untrusted .mtl files from external sources.