Integer overflow in Tencent Ncnn
CVE-2026-112074
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Tencent Ncnn — versions 44b02dabdcf97499281a4692ebd65bad73dcf8b6
Weakness classification (CWE)
References
- vuldb.com/vuln/421753 (technical-description, vdb-entry)
- vuldb.com/vuln/421753/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-112074 (third-party-advisory)
- vuldb.com/submit/1009498 (third-party-advisory)
- github.com/Tencent/ncnn/issues/7035 (issue-tracking, exploit)
- github.com/Tencent/ncnn/ (product)
Frequently asked questions
- What is CVE-2026-112074?
- CVE-2026-112074 is a medium-severity vulnerability in Tencent Ncnn, classified under CWE-189. CVSS score: 6.3/10. Published 2026-10-19.
- How severe is CVE-2026-112074?
- Medium severity. CVSS v3 base score is 6.3 out of 10.