Out-of-Bounds Read Vulnerability in Tencent ncnn MatMul Component
CVE-2026-112073

5.3MEDIUM

Key Information:

Vendor: Tencent
Status: Ncnn
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112073?

A vulnerability has been detected in Tencent's ncnn framework, specifically within the function matmul_transb located in src/layer/matmul.cpp. This vulnerability allows for an out-of-bounds read, potentially enabling attackers to read data beyond the boundaries allocated for a buffer. The exploit is accessible remotely, increasing its risk and potential for abuse. Although the issue was reported to the development team early on, there has been no response or patch issued to address the vulnerability, leaving affected systems at risk.

Affected Version(s)

ncnn 44b02dabdcf97499281a4692ebd65bad73dcf8b6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112073 - Proof of Concept