CVE-2026-112074: Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required for exploitation?
The issue is described as remotely exploitable with low attack complexity and no privileges required. However, user interaction is required according to the supplied vector.
Are public exploit details available?
Yes. The available information states that an exploit has been released publicly and may be used in attacks.
Which releases should be considered exposed?
Tencent ncnn versions up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6 are identified as affected. The provided data does not identify a fixed version or commit.
Is a vendor fix available?
No vendor response or remediation is identified in the provided information. The project was reportedly notified through an issue report but had not responded at the time of publication.