Live › vulnerability › CVE-2026-112074
Go to dashboardTencent ncnn, a neural network inference library, has an integer overflow in its yuv420sp2rgb image conversion function (src/mat_pixel.cpp). The sources say an attacker can trigger it remotely and that a public exploit exists, but they do not state the resulting code execution or data impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that link ncnn and pass image data it can reach, such as a service that decodes or converts uploaded frames for inference. The sources list the affected version only as up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6 and do not say which deployments are exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112074")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.