Is CVE-2026-112073 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112073 being exploited in the wild.

How severe is CVE-2026-112073?

Medium severity, with a CVSS score of 6.3, published 19 October 2026.

Which products and versions are affected?

Tencent Ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.

Is there a fix for CVE-2026-112073?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112073 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112073?

Check whether you run Tencent Ncnn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112073: Tencent ncnn MatMul out-of-bounds read

CVE-2026-112073 · Severity: medium · CVSS 6.3 · Published 2026-10-19

Tencent ncnn is a neural network inference framework for mobile platforms. A bug in the MatMul layer fails to validate consistency between input matrix dimensions, allowing an attacker to craft a malicious model that triggers an out-of-bounds memory read during matrix operations. This could crash the application or potentially leak sensitive data.

Technologies: Tencent Ncnn. Vendors: Tencent.

Quick answers

Is CVE-2026-112073 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112073 being exploited in the wild.
How severe is CVE-2026-112073?: Medium severity, with a CVSS score of 6.3, published 19 October 2026.
Which products and versions are affected?: Tencent Ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.
Is there a fix for CVE-2026-112073?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112073 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112073?: Check whether you run Tencent Ncnn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MatMul layer in src/layer/matmul.cpp sets the inner dimension K from input A's width without validating it matches input B's width. When A.w exceeds B.w, the gemm_x86_avx.cpp transpose_pack_B_tile function reads past B's allocated buffer boundary. The vulnerability is triggered remotely by providing a crafted model file with mismatched input dimensions; no authentication or user interaction required.

Affected products

Tencent ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6

Timeline

2026-10-01: disclosed: Issue #7034 reported on GitHub
2026-10-19: advisory: CVE-2026-112073 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.