CVE-2026-112074

MediumCVSS 6.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A flaw was found in Tencent ncnn in the ncnn::yuv420sp2rgb function (src/mat_pixel.cpp) within the Conversion API component. The manipulation results in an integer overflow. The exploit is publicly available and can be launched remotely.

Risk Assessment

A remote attacker could trigger an integer overflow, potentially leading to memory corruption or application crash when processing image data. Since the exploit is public, the risk of exploitation is high.

Recommendation

Update ncnn to a version containing the fix or restrict processing of untrusted YUV input. Monitor the project for patch announcements.

Other vulnerabilities in Tencent ncnn

CVE-2026-112073Medium
A vulnerability was identified in Tencent ncnn in the matmul_transb function (src/layer/matmul.cpp) within the MatMul component. The manipulation leads to an out-of-bounds read. The exploit is publicly available and can be initiated remotely.

Original NVD description (English source)

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS