What is the CVSS score of CVE-2026-50144?

CVE-2026-50144 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ncnn are affected by CVE-2026-50144?

Tencent's ncnn neural network inference library contains a heap memory corruption vulnerability triggered by maliciously crafted model files, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-50144?

Within 24 hours, identify and catalog all production systems using Tencent ncnn, flagging those processing model files from external or untrusted sources. Within 7 days, obtain and deploy the upstream source-code fix via recompilation, or implement strict .param file validation controls pending vendor-released patch. Within 30 days, complete full regression testing with the patched ncnn version and deploy to all affected production systems.

ncnn CVE-2026-50144

EUVD-2026-44794 HIGH

Improper Input Validation (CWE-20)

2026-07-15 GitHub_M

Buffer Overflow Suse Tencent Ncnn

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Exploitation needs a victim to load a malicious local model file, so AV:L and UI:R with PR:N; a heap-write corruption yields I:H/A:H but no disclosure, so C:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:32 vuln.today

Analysis Generated

Jul 15, 2026 - 20:32 vuln.today

CVE Published

Jul 15, 2026 - 20:04 cve.org

HIGH 7.1

DescriptionCVE.org

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

AnalysisAI

Out-of-bounds heap write in Tencent's ncnn neural-network inference framework allows a crafted .param model file to corrupt heap memory when parsed by Net::load_param(). Because ParamDict::load_param() and load_param_bin() validated the parsed parameter id only against the upper bound (id >= NCNN_MAX_PARAM_COUNT), a negative id indexes before the params[] array, giving an attacker a write primitive below the allocated buffer. No public exploit is identified at time of analysis and the issue is not in CISA KEV; an upstream source-code fix is available.

Technical ContextAI

ncnn (CPE cpe:2.3:a:tencent:ncnn) is a widely used C++ neural-network inference framework optimized for mobile/embedded deployment that consumes model definitions from .param files in both text and binary form. The root cause is CWE-20 improper input validation: in src/paramdict.cpp the parameter id read from the untrusted model file was bounds-checked only with 'id >= NCNN_MAX_PARAM_COUNT', omitting any lower-bound check. A negative id therefore passes validation and is then used to index the fixed-size params[NCNN_MAX_PARAM_COUNT] member, producing an out-of-bounds heap write at a negative offset below the array base. The fix adds 'id < 0 ||' to both the text loader (load_param) and the binary loader (load_param_bin).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from commit 5a0288f255daa6c3294f77109f67718e434ec020 (https://github.com/Tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020), which adds a lower-bound 'id < 0' check to both load_param and load_param_bin, or upgrade to an ncnn release that includes it; consult the advisory at https://github.com/Tencent/ncnn/security/advisories/GHSA-jxmc-3mv6-7pwr for release guidance. Because no fixed release tag is provided in the input, verify the shipping version contains the patched paramdict.cpp before relying on it. As a compensating control until patched, do not load .param/.param.bin files from untrusted sources - restrict model loading to a trusted, integrity-verified pipeline (e.g. signed or checksummed model artifacts), which trades off the ability to accept arbitrary user-supplied models. If rebuilding is possible, applying the two-line diff locally is low-risk with no functional side effect on valid models.