---
id: CVE-2026-112074
title: Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
summary: >-
  A security flaw has been discovered in Tencent ncnn up to
  44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the
  function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component
  Conversion API. The manipulation…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-190
  - CWE-189
vendor: Tencent
product: ncnn
affected:
  - ncnn 44b02dabdcf97499281a4692ebd65bad73dcf8b6
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T16:37:06.270686Z'
exploitAvailable: true
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:37:33.056Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112074'
references:
  - url: 'https://vuldb.com/vuln/421753'
    label: >-
      VDB-421753 | Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb
      integer overflow
  - url: 'https://vuldb.com/vuln/421753/cti'
    label: 'VDB-421753 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112074'
    label: CVE-2026-112074 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1009498'
    label: 'Submit #1009498 | Tencent ncnn master 3b7bdba Integer Overflow'
  - url: 'https://github.com/Tencent/ncnn/issues/7035'
  - url: 'https://github.com/Tencent/ncnn/'
tags:
  - cve.org
  - exploit-available
epss: 0.0024
epssPercentile: 0.14086
ingestedAt: '2026-10-19T04:02:15.998Z'
---

## Overview

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `ncnn 44b02dabdcf97499281a4692ebd65bad73dcf8b6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.