Read the docs
TI-2023-01482 Aliases CVE-2023-1570GHSA-fc3g-9fvp-8rwq

syoyo tinydng tiny_dng_loader.h __interceptor_memcpy heap-based overflow

Priority LOW 25CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.00389 33rd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
syoyotinydngall versions—No fix listedCNA
  • tinydng Vendorsyoyo Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tinydng_project:tinydng:*:*:*:*:*:*:*:*before 2023-02-20VulnerableTinydng Project
  • cpe:2.3:a:tinydng_project:tinydng:*:*:*:*:*:*:*:* Versions before 2023-02-20 Vulnerable ·Tinydng Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1570
  2. 2026-10-03 Alias added: GHSA-fc3g-9fvp-8rwq

References

Exploit 3

  • TI-2026-74091 Heap out-of-bounds read in Tinyexr multipart EXR header parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-49934 tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences