CVE-2026-112073 in ncnn
Summary
by MITRE • 10/19/2026
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability resides within the Tencent ncnn deep learning inference framework, specifically affecting versions up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6. This high-performance neural network inference library is widely deployed in mobile and embedded devices for real-time computer vision tasks such as object detection, facial recognition, and image segmentation. The specific flaw is located in the matmul_transb function within the src/layer/matmul.cpp source file, which handles matrix multiplication operations with transposed inputs. This component is critical to the performance of many deep learning models that rely on linear algebra transformations for feature extraction and classification.
The technical nature of this vulnerability is an out-of-bounds read error, classified under CWE-125 in the Common Weakness Enumeration standard. An out-of-bounds read occurs when a program attempts to access memory locations outside the intended buffer boundaries. In the context of matrix multiplication with transposition, improper calculation of stride or dimension parameters can lead the execution pointer to reference memory addresses that are not allocated for the current operation. This flaw allows an attacker who supplies maliciously crafted input tensors to trigger unauthorized memory reads. While out-of-bounds reads typically result in information disclosure rather than immediate code execution, they can leak sensitive data from adjacent memory regions or cause application crashes leading to denial of service conditions.
The operational impact of this vulnerability is significant due to the remote nature of the attack vector and the availability of public exploits. Attackers can initiate exploitation remotely by providing specially constructed model inputs that trigger the faulty matmul_transb logic during inference. The existence of publicly available exploit code increases the risk landscape considerably, as it lowers the barrier for entry for less sophisticated threat actors who may leverage existing tools to target vulnerable deployments. This is particularly concerning in environments where ncnn is used in server-side applications or cloud-based AI services that process untrusted user inputs directly through model inference pipelines.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1083, which covers File and Directory Discovery, as out-of-bounds reads can be leveraged to read arbitrary memory contents including credentials or internal application states. Furthermore, if the leaked information is used for further exploitation steps such as bypassing authentication mechanisms or understanding system architecture, it may also relate to ATT&CK technique T1087, Account Discovery. The lack of a response from the project maintainers despite early notification through an issue report exacerbates the risk, leaving users without official patches or workarounds in the short term.
Mitigation strategies for this vulnerability require immediate attention given the absence of vendor-provided fixes. Organizations utilizing affected versions of ncnn should consider upgrading to a patched version if one becomes available from alternative forks or community-maintained branches that have addressed the issue. In the interim, input validation and sanitization techniques must be implemented at the application layer to ensure that tensor dimensions passed to matrix multiplication operations are within expected bounds. Additionally, deploying runtime protection mechanisms such as Address Sanitizer in development environments can help detect similar issues before deployment. For production systems, restricting network access to inference endpoints and implementing strict rate limiting can reduce the attack surface available for remote exploitation attempts until a permanent code fix is integrated into the primary ncnn repository.