{"id":"CVE-2026-112073","kind":"vulnerability","aliases":["CVE-2026-112073"],"related":[],"title":"Tencent ncnn: out-of-bounds read in MatMul layer during matrix multiplication","description":"A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Tencent's ncnn neural network inference library has an out-of-bounds read in the matmul_transb function of its MatMul layer, reachable through crafted model input. An attacker can read memory beyond the intended buffer, which may leak data from the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","ncnn","on-device-ml","package","self-hosted"],"not_affected_if":["trusted-models-only"],"how_to_check":"- Check the ncnn version or commit in use against `44b02dabdcf97499281a4692ebd65bad73dcf8b6`; the sources do not name a fixed release.\n- Look for the MatMul layer (src/layer/matmul.cpp) in builds that load untrusted models.","fix":"- unknown: the sources say the project has not responded to the report and name no patched version or commit.\n- Until a fix exists, avoid loading untrusted or externally supplied models with ncnn.","status":"open","published_at":"2026-10-19T04:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:26+00:00","updated_at":"2026-10-25T03:23:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources say the project has not responded to the report and name no patched version or commit.\n- Until a fix exists, avoid loading untrusted or externally supplied models with ncnn.","reach":"internet","title":"Tencent ncnn: out-of-bounds read in MatMul layer during matrix multiplication","impact":"medium","summary":"Tencent's ncnn neural network inference library has an out-of-bounds read in the matmul_transb function of its MatMul layer, reachable through crafted model input. An attacker can read memory beyond the intended buffer, which may leak data from the process.","category":"package","nicknames":[],"who_cares":["ncnn","c++","on-device-ml","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads adjacent process memory remotely through crafted inputs","analyst_note":"Check the ncnn repository issue tracker and the NVD entry for the triggering input format, affected versions, and whether a fix has landed.","how_to_check":"- Check the ncnn version or commit in use against `44b02dabdcf97499281a4692ebd65bad73dcf8b6`; the sources do not name a fixed release.\n- Look for the MatMul layer (src/layer/matmul.cpp) in builds that load untrusted models.","needs_analyst":true,"not_affected_if":["trusted-models-only"],"who_is_affected":"Teams that embed ncnn and feed it models or inputs they do not fully control are exposed, since the flaw is in the MatMul layer's handling of input shapes. Systems that only run models they built and trust are less exposed. The sources do not say which model shapes trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":3384,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112073':16A,19A '-2026':15A,18A '44b02dabdcf97499281a4692ebd65bad73dcf8b6':83C 'affect':84C 'attack':59B,111C 'avail':120C 'beyond':63B 'bound':6A,42B,108C 'buffer':66B 'c':20B 'compon':99C 'craft':55B 'cve':14A,17A 'data':70B 'devic':24B 'earli':132C 'exploit':117C 'file':95C 'function':48B,90C 'host':29B 'identifi':77C 'infer':35B 'inform':128C 'initi':114C 'input':57B 'intend':65B 'issu':135C 'layer':10A,52B 'lead':103C 'leak':69B 'librari':36B 'manipul':102C 'matmul':9A,46B,51B,91C,100C 'matrix':12A 'may':68B 'memori':62B 'might':122C 'ml':25B 'model':56B 'multipl':13A 'ncnn':2A,21B,32B,80C 'network':34B 'neural':33B 'on-device-ml':22B 'out-of-bound':3A,39B,105C 'packag':26B 'problem':131C 'process':73B 'project':126C 'public':119C 'reachabl':53B 'read':7A,43B,61B,109C 'remot':115C 'report':136C 'respond':140C 'self':28B 'self-host':27B 'src/layer/matmul.cpp':96C 'tencent':1A,30B,79C 'transb':47B,92C 'use':124C 'vulner':75C,87C 'yet':141C","nicknames":[],"mitigations":[],"who_affected":"Teams that embed ncnn and feed it models or inputs they do not fully control are exposed, since the flaw is in the MatMul layer's handling of input shapes. Systems that only run models they built and trust are less exposed. The sources do not say which model shapes trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T04:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112073","severity":null,"published_at":"2026-10-19T04:17:08+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}