ncnn CVE-2026-50144

Exploitation requires the target application to call Net::load_param() (or the binary load_param_bin path) on an attacker-controlled .param/.param.bin file whose parsed parameter id is negative - that specific malformed field IS the trigger. Limiting factors: the attacker must get the victim to load the malicious model (UI:R), the vector is local rather than remote (AV:L), and the deployment must actually accept untrusted model files, so applications that only load bundled, trusted models are not exposed. No authentication or special privileges are needed (PR:N) once the malicious file reaches the parser.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 7.1) captures the profile well: the vector is local because exploitation requires the victim application to load an attacker-supplied model file (UI:R), not a remote network service. No privileges are required (PR:N) and complexity is low (AC:L) once a malicious .param is delivered. Impact is high to integrity and availability but none to confidentiality, consistent with a heap-corruption/crash primitive. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation-probability signals are absent; realistic risk is moderate and scales entirely with whether a deployment ingests untrusted models. This is a genuine memory-safety bug but not an internet-facing, mass-exploitable one. One tension worth verifying: an OOB heap write can sometimes be escalated to code execution, which the C:N/I:H/A:H scoring does not fully capture - treat the RCE ceiling as uncertain pending exploitability research.

An attacker crafts a malicious .param model file containing a negative parameter id and delivers it to a victim who loads it through an ncnn-based application (for example a mobile app or ML tool that imports third-party models). When Net::load_param() parses the file, ParamDict::load_param() writes out of bounds below the params[] array, corrupting the heap and enabling denial of service or potentially further memory-corruption exploitation. No public exploit is identified at time of analysis, and the local vector plus required user interaction constrain the attack.