CVE-2026-50144

Katalog CVE

CVSS 7.1 · High EPSS 0,16%

Kerentanan Improper Input Validation. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-129: Improper Validation of Array Index
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020
• https://github.com/Tencent/ncnn/security/advisories/GHSA-jxmc-3mv6-7pwr