Vulnerability Spotlight: Use-after-free vulnerability in tinyobjloader

Summary: Lilith of Cisco Talos discovered an improper array index validation vulnerability in the LoadObj function of tinyobjloader, an open-source .obj loader used in graphics-rendering projects. A specially crafted file can trigger an index out-of-bounds condition that may lead to code execution, affecting tinyobjloader v2.0-rc1 and development commit 79d4421, with Snort rules 56539 and 56540 released to detect exploitation attempts.
Key Takeaway: The flaw lives in a loader embedded inside graphics-rendering projects, so the exposure reaches every application that bundled the affected versions, and code execution follows from nothing more than a user opening a malicious file.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-28589
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026