---
id: "CVE-2026-112074"
kind: "vulnerability"
aliases: ["CVE-2026-112074"]
title: "Tencent ncnn: integer overflow in YUV-to-RGB conversion, remote trigger"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "ml-inference", "ncnn", "package", "self-hosted"]
not_affected_if: ["no-untrusted-image-input"]
published_at: "2026-10-19T04:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112074", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Tencent ncnn: integer overflow in YUV-to-RGB conversion, remote trigger

Tencent ncnn, a neural network inference library, has an integer overflow in its yuv420sp2rgb image conversion function (src/mat_pixel.cpp). The sources say an attacker can trigger it remotely and that a public exploit exists, but they do not state the resulting code execution or data impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown: no fixed version is named and the project had not responded to the report at the time of the source.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112074

## From the sources

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_