Is CVE-2026-112074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112074 being exploited in the wild.

How severe is CVE-2026-112074?

Medium severity, with a CVSS score of 6.3, published 19 October 2026.

Which products and versions are affected?

Tencent Ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.

Is there a fix for CVE-2026-112074?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112074 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112074?

Check whether you run Tencent Ncnn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112074: Tencent ncnn integer overflow in yuv420sp2rgb

CVE-2026-112074 · Severity: medium · CVSS 6.3 · Published 2026-10-19

Tencent ncnn is a neural network inference framework used in mobile and embedded applications. The yuv420sp2rgb function, which converts YUV-format video frames to RGB color space, contains an integer overflow vulnerability in width and height calculations. An attacker can trigger out-of-bounds memory reads and writes, leading to information disclosure, crashes, or potential code execution when processing specially crafted image dimensions.

Technologies: Tencent Ncnn. Vendors: Tencent.

Quick answers

Is CVE-2026-112074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112074 being exploited in the wild.
How severe is CVE-2026-112074?: Medium severity, with a CVSS score of 6.3, published 19 October 2026.
Which products and versions are affected?: Tencent Ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.
Is there a fix for CVE-2026-112074?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112074 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112074?: Check whether you run Tencent Ncnn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an integer overflow in the calculation of a pointer offset in the ncnn::yuv420sp2rgb() function (mat_pixel.cpp:1953), where multiplication of width × height (as 32-bit signed integers) wraps around when values exceed INT_MAX. The function also lacks buffer size validation. An attacker passing large width and height parameters (e.g., 40000×60000) causes the pointer to wrap to a negative offset, enabling out-of-bounds reads; similar issues exist in related drawing functions that perform writes to wrapped offsets.

Affected products

Tencent ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6

Timeline

2026-10-19: disclosed
2026-10-01: other: Reported via GitHub issue #7035; project had not responded as of that date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.