EUVD-2026-101662
GHSA-r62r-cfcm-xfww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .tmfile with bad offset_root
-
ExploitVictim loads model via get_tm_file_model
-
ImpactOut-of-bounds read leaks memory or crashes process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to load a maliciously crafted Tengine .tmfile model file through the tmfile Model Loader's get_tm_file_model function, where a manipulated offset_root argument drives the out-of-bounds read in source/serializer/tmfile/tm2_serializer.c. The limiting factor is user interaction (UI:P): the vulnerability is not reachable without the victim ingesting an attacker-supplied model file, so systems that only load trusted, locally-produced models are not realistically exposed. No authentication is indicated (PR:N), and affected builds are OAID Tengine versions up to and including 1.12.0 with no vendor patch currently available. |
| Impact | This is a low-priority issue despite being publicly disclosed. The authoritative signal is the vendor-neutral CVSS 4.0 base score of 2.1 (Low), reflecting that this is an out-of-bounds READ (CWE-125) with only Low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and no scope change (SC:N/SI:N/SA:N). The vector marks UI:P, meaning exploitation is passive-user-interaction dependent: a victim application/user must load a crafted .tmfile model into Tengine. Exploit status is 'publicly available exploit code exists' (a VulDB-referenced GitHub issue), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of real-world exploitation - POC availability must not be conflated with active exploitation. A key conflict to flag: the CVSS vector and VulDB wording state AV:N ('launch the attack remotely'), yet the root cause is parsing of a locally-supplied model file in get_tm_file_model, which is functionally a file-parsing bug requiring the target to ingest attacker-controlled input - many analysts would assess this as AV:L. Verify the delivery path with the deployment context. Additionally, the project 'has not responded yet,' so no patch is confirmed available. |
| Exploit ScenarioDerived | An attacker crafts a malicious Tengine .tmfile model containing a manipulated offset_root value and distributes it (e.g., via a model-sharing repository or supply-chain path). When a victim application or user loads this model through get_tm_file_model, the parser performs an out-of-bounds read, potentially disclosing adjacent heap/stack memory or crashing the process. A public proof-of-concept is referenced via the OAID/Tengine GitHub issue tracker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the tmfile model loader of OAID Tengine (all releases up to and including 1.12.0) allows a malformed .tmfile model to drive reads beyond the end of an allocated buffer through the offset_root argument in source/serializer/tmfile/tm2_serializer.c. Exploitation is unauthenticated but requires user interaction - the victim must load the attacker-supplied model file - so only environments that ingest models from untrusted or third-party sources are realistically exposed, and the independent assessment rates this a low-priority issue notwithstanding its public disclosure. Publicly available exploit code exists (a public GitHub issue, OAID/Tengine#1453), but there is no evidence of active exploitation and no vendor patch has been released at time of analysis; impact is bounded to low-severity information disclosure and availability effects.
RemediationAI
No vendor-released patch identified at time of analysis: the report reached the project through https://github.com/OAID/Tengine/issues/1453 and, per the available data, the maintainers have not responded, so no fixed Tengine version can be cited and simply 'upgrading to the latest release' does not remediate the bug (1.12.0 remains the newest affected build). Until an upstream fix is published, apply compensating controls that match the actual exploitation path. First, treat .tmfile model artifacts as untrusted input: restrict model loading to models produced internally or from sources covered by cryptographic integrity verification (checksum/signature) checked before the loader is invoked, which removes the trigger entirely at the cost of blocking third-party model formats. Second, if untrusted models must be processed, isolate the loading and inference process in an unprivileged container or sandbox with a restrictive seccomp/AppArmor profile and no access to secrets or host filesystems; this does not prevent the out-of-bounds read but limits what leaked memory contains and contains any crash, with the trade-off of added operational overhead and possible performance impact. Third, where a local patch build is feasible, add an explicit bounds check on offset_root (and related offsets) inside get_tm_file_model in source/serializer/tmfile/tm2_serializer.c, rejecting values outside the mapped model region - this is the minimal upstream-style fix and should be validated with fuzzing of the tmfile parser before deployment, since it changes parser behavior for edge-case models. Monitor the project repository and the advisory records for a patched release before relaxing these controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-125 out-of-bounds read in OAID Tengine, a lightweight neural-network inference engine (distinct from the nginx-derived Alibaba web server of the same name, which is not affected here). Tengine's serializer subsystem deserializes models stored in its proprietary .tmfile container; in source/serializer/tmfile/tm2_serializer.c the function get_tm_file_model consumes the caller-controllable offset_root argument to index into the memory-mapped/loaded model buffer without validating that the resulting access stays within bounds. Because the offset is not sanity-checked, a crafted tmfile can force the parser to read past the end of the buffer, leaking adjacent process memory into model structures or the inference output (information disclosure) and potentially causing an out-of-bounds access that terminates the process (availability impact). The CPE cpe:2.3:a:oaid:tengine:*:*:*:*:*:*:*:* with a wildcard version field indicates every published build matches, and the enumerated EUVD versions (1.0 through 1.12.0) confirm that the entire release history is affected rather than a single regression. Root cause is classically missing bounds validation on a length/offset field taken from an untrusted serialized artifact, and the general fix pattern is to reject offset_root values that exceed the containing region before dereferencing them.
Know when Tengine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Root cause is parsing an attacker-supplied model file, so AV:L and UI:R; out-of-bounds read yields limited memory disclosure (C:L) and possible crash (A:L), with no integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB