# CVE-2026-112074: Tencent ncnn integer overflow in yuv420sp2rgb

Source: https://junglewise.ai/threats/cve-2026-112074-a-security-flaw-has-been-discovered-in-tencent-ncnn-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112074 · Severity: medium · CVSS 6.3 · Published 2026-10-19

Tencent ncnn is a neural network inference framework used in mobile and embedded applications. The yuv420sp2rgb function, which converts YUV-format video frames to RGB color space, contains an integer overflow vulnerability in width and height calculations. An attacker can trigger out-of-bounds memory reads and writes, leading to information disclosure, crashes, or potential code execution when processing specially crafted image dimensions.

Technologies: [Tencent Ncnn](https://junglewise.ai/threats/technologies/ncnn). Vendors: [Tencent](https://junglewise.ai/threats/vendors/tencent).

## Quick answers

**Is CVE-2026-112074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112074 being exploited in the wild.

**How severe is CVE-2026-112074?** Medium severity, with a CVSS score of 6.3, published 19 October 2026.

**Which products and versions are affected?** Tencent Ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.

**Is there a fix for CVE-2026-112074?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112074 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112074?** Check whether you run Tencent Ncnn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow in the calculation of a pointer offset in the ncnn::yuv420sp2rgb() function (mat_pixel.cpp:1953), where multiplication of width × height (as 32-bit signed integers) wraps around when values exceed INT_MAX. The function also lacks buffer size validation. An attacker passing large width and height parameters (e.g., 40000×60000) causes the pointer to wrap to a negative offset, enabling out-of-bounds reads; similar issues exist in related drawing functions that perform writes to wrapped offsets.

## Affected products

- Tencent ncnn up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6

## Timeline

- 2026-10-19: disclosed
- 2026-10-01: other: Reported via GitHub issue #7035; project had not responded as of that date

## References

- [https://github.com/Tencent/ncnn/](https://github.com/Tencent/ncnn/)
- [https://github.com/Tencent/ncnn/issues/7035](https://github.com/Tencent/ncnn/issues/7035)

## Related threats

- [Tencent ncnn MatMul out-of-bounds read](https://junglewise.ai/threats/cve-2026-112073-a-vulnerability-was-identified-in-tencent-ncnn-up-to)
- [Tencent ncnn heap out-of-bounds write in ParamDict::load_param](https://junglewise.ai/threats/cve-2026-50144-tencent-ncnn-heap-out-of-bounds-write-in-paramdict-load-param)