Tencent ncnn EUVD-2026-104055

Exploitation requires the victim to load and run inference on an attacker-supplied ncnn model/input that reaches the MatMul layer's matmul_transb code path (the transposed-B matrix-multiply operation) with manipulated dimension parameters that exceed buffer bounds. The CVSS UI:P metric confirms a user-interaction/content-processing step is mandatory - there is no standalone network-listening service being attacked; the attacker must get their crafted model consumed by the target application. This limits exploitation to workflows that ingest untrusted third-party models (e.g., downloaded or user-submitted models). Impact is bounded to memory disclosure and possible crash; no authentication is required (PR:N) but the malicious data must be processed by a vulnerable build up to commit 44b02dabdcf97499281a4692ebd65bad73dcf8b6.

This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) reflects an out-of-bounds read (CWE-125) with low impact and a required user-interaction (UI:P) component, meaning the victim must load or process attacker-supplied data (a crafted model/weights handled by the MatMul layer). Although the vector is marked AV:N (network), the realistic delivery path for an inference library like ncnn is a malicious model or input file rather than a listening network service, so 'remote' here means attacker-supplied content, not a directly reachable endpoint - verify the deployment context. The CVSS Exploit Maturity is E:P (Proof-of-Concept), consistent with the input signal that a POC is publicly available via the GitHub issue; publicly available exploit code exists, but this is distinct from active exploitation. The CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of widespread or targeted in-the-wild use. The VI:L/VA:L (integrity/availability low) ratings are generous for a pure out-of-bounds READ - the realistic primary impact is information disclosure (memory leak) and potential crash (DoS), so treat integrity impact as uncertain. Net: a low-impact, POC-stage memory-disclosure bug in an AI inference library whose vendor has not yet responded; patch when practical but it is not a high-real-risk flaw.

An attacker crafts a malicious ncnn model or weight file with manipulated MatMul (matmul_transb) dimensions and distributes it (e.g., via a model-sharing repository or supply-chain). When a victim application loads and runs inference on the crafted model, the out-of-bounds read in src/layer/matmul.cpp leaks adjacent process memory or crashes the process. A public proof-of-concept exists (referenced in the Tencent/ncnn GitHub issue), lowering the barrier to reproduction.