{"id":"CVE-2026-112074","kind":"vulnerability","aliases":["CVE-2026-112074"],"related":[],"title":"Tencent ncnn: integer overflow in YUV-to-RGB conversion, remote trigger","description":"A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Tencent ncnn, a neural network inference library, has an integer overflow in its yuv420sp2rgb image conversion function (src/mat_pixel.cpp). The sources say an attacker can trigger it remotely and that a public exploit exists, but they do not state the resulting code execution or data impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","ml-inference","ncnn","package","self-hosted"],"not_affected_if":["no-untrusted-image-input"],"how_to_check":"- unknown","fix":"- unknown: no fixed version is named and the project had not responded to the report at the time of the source.","status":"open","published_at":"2026-10-19T04:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:24+00:00","updated_at":"2026-10-25T03:23:24+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T03:23:24Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: no fixed version is named and the project had not responded to the report at the time of the source.","reach":"internet","title":"Tencent ncnn: integer overflow in YUV-to-RGB conversion, remote trigger","impact":"medium","summary":"Tencent ncnn, a neural network inference library, has an integer overflow in its yuv420sp2rgb image conversion function (src/mat_pixel.cpp). The sources say an attacker can trigger it remotely and that a public exploit exists, but they do not state the resulting code execution or data impact.","category":"package","nicknames":[],"who_cares":["ncnn","c++","ml-inference","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not state the impact beyond the overflow","analyst_note":"Find whether the overflow leads to memory corruption or code execution, which release or commit fixes it, and the exploit's source (nvd link only; check the ncnn GitHub issue).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-image-input"],"who_is_affected":"Applications that link ncnn and pass image data it can reach, such as a service that decodes or converts uploaded frames for inference. The sources list the affected version only as up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6 and do not say which deployments are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000604,"input_tokens":3393,"output_tokens":530,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112074':15A,18A '-2026':14A,17A '44b02dabdcf97499281a4692ebd65bad73dcf8b6':84C 'affect':85C 'api':102C 'attack':50B,110C,128C 'c':19B 'code':68B 'compon':100C 'convers':10A,43B,101C 'cve':13A,16A 'data':71B 'discov':78C 'earli':136C 'execut':69B 'exist':60B 'exploit':59B,116C 'file':96C 'flaw':75C 'function':44B,91C 'host':27B 'imag':42B 'impact':72B 'infer':22B,33B 'inform':132C 'integ':3A,37B,107C 'issu':88C,139C 'launch':113C 'librari':34B 'manipul':104C 'may':124C 'ml':21B 'ml-infer':20B 'ncnn':2A,23B,29B,81C,92C 'network':32B 'neural':31B 'overflow':4A,38B,108C 'packag':24B 'problem':135C 'project':130C 'public':58B,122C 'releas':119C 'remot':11A,54B,114C 'report':140C 'respond':144C 'result':67B,105C 'rgb':9A 'say':48B 'secur':74C 'self':26B 'self-host':25B 'sourc':47B 'src/mat_pixel.cpp':45B,97C 'state':65B 'tencent':1A,28B,80C 'trigger':12A,52B 'use':126C 'yet':145C 'yuv':7A 'yuv-to-rgb':6A 'yuv420sp2rgb':41B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that link ncnn and pass image data it can reach, such as a service that decodes or converts uploaded frames for inference. The sources list the affected version only as up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6 and do not say which deployments are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T04:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112074","severity":null,"published_at":"2026-10-19T04:17:08+00:00","modified_at":"2026-10-19T17:17:10+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}