CVE-2026-110694 in Tengine
Summary
by MITRE • 10/14/2026
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The OAID Tengine framework, specifically versions up to 1.12.0, contains a critical security flaw within its tmfile Model Loader component that poses significant risks to deployed machine learning inference systems. The vulnerability resides in the get_tm_file_model function located in the source/serializer/tmfile/tm2_serializer.c file. This specific code path is responsible for parsing and loading model files into memory for execution by the Tengine runtime engine, which is widely used in edge computing and IoT devices for efficient neural network inference. The core technical flaw involves an improper validation of the offset_root argument during the serialization process. When a maliciously crafted tmfile model is processed, the function fails to adequately verify that the specified root offset falls within the bounds of the allocated memory buffer or the file size. This lack of rigorous boundary checking allows for an out-of-bounds read operation, where the application attempts to access memory locations beyond the intended limits of the data structure being parsed.
From a technical perspective, this vulnerability is classified under CWE-125, which denotes Out-of-Bounds Read. The exploitation mechanism relies on providing a malformed model file where the offset_root parameter points to an address outside the valid range of the input buffer or associated metadata structures. Because Tengine operates as a service that often processes inputs from untrusted sources in edge scenarios, this flaw can be triggered remotely without requiring prior authentication if the inference endpoint is exposed to external networks. The attacker constructs a specially designed tmfile model file containing specific byte sequences and offset values that manipulate the parser's internal state. Upon processing this malicious input, the application reads sensitive data from adjacent memory regions or potentially crashes due to accessing unmapped pages, leading to denial of service conditions. In more sophisticated attack scenarios involving information disclosure, an attacker could leverage the out-of-bounds read to leak confidential information stored in nearby memory locations, such as cryptographic keys, user credentials, or other proprietary model weights that were previously loaded into the same process space.
The operational impact of this vulnerability is severe due to its remote exploitability and the public availability of proof-of-concept exploits. Organizations relying on OAID Tengine for deploying AI models at the edge are particularly vulnerable because these devices often have limited security controls compared to traditional server environments. The ability to remotely trigger an out-of-bounds read means that attackers can potentially achieve arbitrary code execution if combined with other memory corruption techniques, or simply cause service disruption by crashing the inference daemon. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as a successful exploitation could allow an attacker to execute commands on the host system through the compromised process context. Furthermore, it relates to ATT&CK tactic TA0006, Credential Access, if sensitive data is exfiltrated via the memory leak vector inherent in out-of-bounds reads. The fact that exploit code has been disclosed publicly significantly lowers the barrier for entry for malicious actors who may not possess advanced reverse engineering skills but can utilize existing tools to target vulnerable deployments.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade OAID Tengine to a version greater than 1.12.0, where the maintainers are expected to have implemented proper bounds checking for the offset_root parameter within the tmfile serializer logic. Until an official patch is available or verified in newer releases, organizations should implement strict input validation at the network perimeter by inspecting incoming model files before they reach the Tengine runtime engine. This can be achieved through sandboxed execution environments where untrusted models are processed with restricted memory access privileges. Additionally, enabling Address Sanitizer (ASan) during development and testing phases helps detect such boundary violations early in the software lifecycle. Security teams should also monitor for anomalous behavior indicative of out-of-bounds reads, such as unexpected process crashes or unusual memory allocation patterns associated with model loading services. Given that the project has not yet responded to public issue reports, relying solely on upstream fixes is risky; therefore, applying compensating controls like network segmentation and strict file type validation remains critical for maintaining security posture in environments utilizing this framework.