Submit #1003957: OPEN AI LAB Tengine commit 5ec1c383c8adb0078c025b9fec6fa3dea254034a (master branch, 2024-09-15, latest code; no release tags) Out-of-bounds Read

A vulnerability was found in Tengine commit 5ec1c383c8adb0078c025b9fec6fa3dea254034a (master branch, 2024-09-15) and classified as high 8.1. Affected is the tmfile model loader component (source/serializer/tmfile/tm2_serializer.c, functions load_model/load_mem/get_tm_file_model/get_tm_file_subgraph). The manipulation of the argument TM2_Header.offset_root within a crafted .tmfile model file leads to an out-of-bounds read (heap-buffer-overflow READ of size 4, 8 bytes past the end of the file-sized heap allocation). It is possible to launch the attack remotely. User interaction is required because a victim must load the crafted model file.

Technical Details
- Affected file/function: source/serializer/tmfile/tm2_serializer.c / load_model(), get_tm_file_model(), get_tm_file_subgraph(); the load_mem() path shares the same unchecked arithmetic
- Vulnerable parameter: TM2_Header.offset_root (and every table offset) read from the untrusted .tmfile
- Attack vector: Network (malicious model file distributed via model zoo/download/IPC)
- Privileges required: None
- Trigger condition: the loader allocates a heap buffer of exactly the file size, records priv->mem_len but never validates any offset against it; offset_root == file length makes the loader form a TM2_Model* one past the end of the allocation and dereference model->offset_vo_subgraphs before the only version check (load_graph(), line 840), aborting with AddressSanitizer heap-buffer-overflow READ of size 4 located 8 bytes to the right of the 4096-byte region

Impact
- Confidentiality: High (out-of-bounds values drive further parsing; adjacent heap data can flow into in-memory graph structures)
- Integrity: None (no write primitive)
- Availability: High (deterministic crash of any application loading the crafted model)

CVSS v3.1
Score: 8.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Timeline
- Discovered: 2026-09-27
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Validate every table offset against the recorded buffer length (priv->mem_len) before pointer formation: reject when offset + sizeof(minimum structure) exceeds mem_len, in both load_model() and load_mem(); start with get_tm_file_model() (header->offset_root + sizeof(TM2_Model)) and get_tm_file_subgraph() (model->offset_vo_subgraphs + sizeof(TM2_Vector_offsets)) and apply the same pattern to all remaining table offsets.

• Source: ⚠️ https://github.com/OAID/Tengine/issues/1453
• User: r1ck99 (UID 100733)
• Submission: 09/28/2026 14:06 (1 month ago)
• Moderation: 10/14/2026 15:47 (16 days later)
• Status: Accepted
• VulDB entry: 419841 [OAID Tengine up to 1.12.0 tmfile Model Loader tm2_serializer.c get_tm_file_model offset_root out-of-bounds]
• Points: 20