Heap Buffer Overflow Vulnerability in tinyobjloader Package
Summary
OSV-2026-371: Heap-buffer-overflow in tinyobj::tryParseDouble. Affects tinyobjloader versions >= f27721f3c9cd20af4d4eee789431b92d0e0c4477, < 966edceaf8cdca7996c4e9a1c5ced2938de63366. Fixed in 966edceaf8cdca7996c4e9a1c5ced2938de63366. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tinyobjloader package is a lightweight C++ library designed for loading Wavefront OBJ files, which are commonly used in 3D graphics applications. It provides a simple interface for parsing and loading 3D models, making it a popular choice among developers in the graphics and game development communities. However, the package has been found to have a vulnerability that can lead to a heap buffer overflow, potentially allowing attackers to exploit the application using this library.
Vulnerability Detail
The vulnerability identified in tinyobjloader is a heap buffer overflow that occurs in the function tinyobj::tryParseDouble. This issue was reported through OSS-Fuzz, which is a service that helps find security vulnerabilities in open-source software. The crash state indicates that the overflow happens during the parsing of double values, which could lead to unauthorized memory access, crashes, or even arbitrary code execution. The vulnerability was introduced in commit f27721f3c9cd20af4d4eee789431b92d0e0c4477 and has been fixed in commit 966edceaf8cdca7996c4e9a1c5ced2938de63366.
How To Fix
Minimum fixed version
966edceaf8cdca7996c4e9a1c5ced2938de63366
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using the affected function tinyobj::tryParseDouble until the package is updated. Additionally, validating input data before parsing can help mitigate the risk of triggering the vulnerability.
Conclusion
The tinyobjloader package has a critical heap buffer overflow vulnerability that can lead to severe security issues. It is essential for developers using this package to update to the latest version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for tinyobjloader →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, leading to memory corruption and potential exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Exploiting this vulnerability could lead to application crashes, unauthorized access to memory, or even arbitrary code execution, posing significant security risks.
Yes, the vulnerability has been fixed in the commit 966edceaf8cdca7996c4e9a1c5ced2938de63366. Users should update to this version or later.
If immediate updates are not possible, consider implementing input validation and avoiding the use of the affected function as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinyobjloader.
