CVE-2020-28589CWE-129

An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421

Critical · published August 11, 2021

CVSS v3.0
9.6
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01880 · 79.3th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2021-08-11T12:37Z
EPSS history
Timeline
  • 11 AUG 12:37Z
    An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421
    cvelistv5