CVE-2026-110694 OAID CVE debrief

Who should care

Defenders responsible for OAID Tengine deployments should assess exposure and verify versions in use, considering potential operational impacts and monitoring for exploitation attempts. This includes reviewing compensating controls, checking relevant monitoring and logs, and tracking exceptions and remediation efforts.

Why it matters

This vulnerability in OAID Tengine can lead to out-of-bounds read, allowing for potential information disclosure. Defenders should verify versions, assess exposure, and monitor for exploitation attempts.

• Verify affected versions of OAID Tengine in use.
• Assess exposure in environments using OAID Tengine.
• Monitor for potential exploitation attempts.

Technical summary

The vulnerability affects OAID Tengine up to version 1.12.0, specifically in the tmfile Model Loader component. The function get_tm_file_model in tm2_serializer.c is vulnerable to an out-of-bounds read. This can be exploited remotely, potentially leading to information disclosure. Defenders should prioritize verifying the affected versions of OAID Tengine and assessing exposure in their environments, considering potential operational impacts and monitoring for exploitation attempts. The project was informed but has not yet responded.

Defensive priority

Defenders should prioritize verifying the affected versions of OAID Tengine and assessing exposure in their environments.

Recommended defensive actions

• Verify the version of OAID Tengine in use and check if it is affected (up to 1.12.0).
• Assess exposure in environments using OAID Tengine.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability in OAID Tengine. However, the corpus lacks specific information on exploitation, impact, or remediation. Defenders should verify affected versions, assess exposure, and monitor for potential exploitation attempts. The vulnerability affects OAID Tengine up to version 1.12.0, specifically in the tmfile Model Loader component.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.