CVE-2026-112073 Tencent CVE debrief

Who should care

Defenders responsible for systems or applications using Tencent ncnn should assess exposure and prioritize verification of the affected version. This includes reviewing system configurations, ensuring appropriate security controls are in place, and monitoring for potential exploits. The urgency is heightened due to the public availability of the exploit. Operational teams, security teams, and vulnerability management teams should all be aware of this issue

Why it matters

CVE-2026-112073 is a vulnerability in Tencent ncnn that allows for remote out-of-bounds reads. Defenders should assess exposure, verify versions, and monitor for exploits.

• Remote attackers may exploit this vulnerability to read out-of-bounds data.
• Defenders need to verify the affected version of Tencent ncnn and assess exposure.
• Exposure could lead to unauthorized data access or system instability.

Technical summary

The vulnerability is in the matmul_transb function of src/layer/matmul.cpp in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6, leading to an out-of-bounds read. This vulnerability can be exploited remotely, and an exploit is publicly available. The affected component is part of the MatMul functionality in Tencent ncnn. Defenders should focus on verifying the affected version and assessing exposure to mitigate potential risks. The vulnerability's impact is primarily related to data access and system stability.

Defensive priority

Defenders should prioritize verifying the affected version of Tencent ncnn and assessing exposure, as the exploit is publicly available.

Recommended defensive actions

• Verify the version of Tencent ncnn in use and compare it to the affected version 44b02dabdcf97499281a4692ebd65bad73dcf8b6.
• Assess exposure based on the affected component and potential attack vectors.
• Monitor for publicly available exploits and consider compensating controls.
• Review and implement vendor guidance or patches as they become available.
• Conduct a thorough review of system configurations and network exposure.
• Ensure that appropriate monitoring and detection mechanisms are in place.
• Track and document remediation efforts and verify the effectiveness of implemented controls.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor comments or additional information are not available. The exploit is publicly available, which increases the risk of exploitation. Defenders should verify the affected version of Tencent ncnn and assess exposure. The vulnerability allows for remote out-of-bounds reads, potentially leading to unauthorized data access or system instability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.