CVE-2026-112074 in ncnn
Summary
by MITRE • 10/19/2026
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within Tencent ncnn, specifically affecting versions up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6, resides in the yuv420sp2rgb function located in src/mat_pixel.cpp. This component is part of ncnn's Conversion API, which handles pixel format transformations essential for image processing tasks such as converting YUV 4:2:0 semi-planar data to RGB formats. The core technical flaw is an integer overflow that occurs during the calculation of memory offsets or buffer sizes required for this conversion process. When input parameters defining the dimensions or stride of the source YUV image are manipulated by an attacker, the arithmetic operations used to determine destination buffer requirements can exceed the maximum value representable by the data type being used. This miscalculation leads to a truncated size value, causing subsequent memory allocation or copy operations to write beyond the bounds of the allocated buffer.
This integer overflow vulnerability falls under CWE-190, which describes Integer Overflow or Wraparound, and is closely related to CWE-787, Out-of-bounds Write, as the direct consequence of the miscalculated size often results in writing data into adjacent memory regions that were not intended for this operation. The flaw allows for remote exploitation because ncnn is frequently integrated into applications that process user-supplied or network-received image and video data. An attacker can craft a malicious input file or stream containing specific YUV dimensions that trigger the overflow condition when passed to the yuv420sp2rgb function. Since the exploit has been released publicly, threat actors are actively leveraging this weakness in automated attacks against vulnerable deployments. The operational impact of such an out-of-bounds write is severe, potentially leading to application crashes through denial of service or, more critically, arbitrary code execution if the attacker can control the data written into adjacent memory structures and manipulate return addresses or function pointers.
The attack vector aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, particularly in scenarios where ncnn is embedded within client-side applications like mobile apps or desktop software that process media files from untrusted sources. It also relates to T1195, Supply Chain Compromise, if the vulnerability exists in a widely used library that downstream developers integrate without adequate security review. The fact that the project was notified early via an issue report but has not yet responded highlights a critical gap in supply chain security and vendor responsiveness. This delay leaves users of affected versions exposed to known exploits with no official patch available from the primary maintainer, forcing organizations relying on ncnn for computer vision or image processing tasks to seek alternative mitigation strategies immediately.
Mitigation efforts must focus on immediate defensive measures given the lack of an upstream fix. Developers should implement strict input validation before calling yuv420sp2rgb, ensuring that all dimension parameters and stride values are within expected bounds and do not cause arithmetic overflow during internal calculations. Using static analysis tools configured to detect integer overflows in C++ codebases can help identify similar vulnerabilities elsewhere in the ncnn integration layer. Additionally, enabling compiler protections such as stack canaries, Address Space Layout Randomization (ASLR), and Control Flow Integrity (CFI) can mitigate the impact of exploitation attempts by making memory corruption attacks more difficult to succeed. Organizations should also consider isolating processes that utilize ncnn for processing untrusted media using sandboxing techniques or containerization to limit the blast radius in case a successful exploit occurs. Until an official patch is released, monitoring network traffic and application logs for anomalous behavior related to image parsing may provide early warning of exploitation attempts targeting this specific vulnerability.