PT-2026-60292 · Ncnn · Ncnn

CVE-2026-50144 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ncnn versions prior to 5a0288f255daa6c3294f77109f67718e434ec020

Description An out-of-bounds heap write occurs in the ncnn::ParamDict::load param() function when Net::load param() processes a malicious .param model file. This happens because the parsed parameter id is only validated against id >= NCNN MAX PARAM COUNT, which allows a negative id to index memory before the params[NCNN MAX PARAM COUNT] array.

Recommendations Update to version 5a0288f255daa6c3294f77109f67718e434ec020 or later.

Exploit

Fix

Improper Validation of Array Index

Memory Corruption

RCE

Weakness Enumeration

CWE-129

CWE-787

CWE-20

Related Identifiers

CVE-2026-50144

GHSA-JXMC-3MV6-7PWR

Affected Products

Ncnn

References · 5

• 🔥 https://github.com/Tencent/ncnn/security/advisories/GHSA-jxmc-3mv6-7pwr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50144.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-50144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50144 · Security Note
• https://github.com/Tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020 · Note