CVE-2026-50144

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50144
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50144.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50144
Aliases
  • GHSA-jxmc-3mv6-7pwr
Published
2026-07-15T20:04:07.099Z
Modified
2026-08-12T16:09:42.956507Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id
Details

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::loadparam() when Net::loadparam() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNNMAXPARAMCOUNT, allowing a negative id to index before the params[NCNNMAXPARAMCOUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50144.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "5a0288f255daa6c3294f77109f67718e434ec020"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-129",
        "CWE-20",
        "CWE-787"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/tencent/ncnn

Affected ranges

Type
GIT
Repo
https://github.com/tencent/ncnn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5a0288f255daa6c3294f77109f67718e434ec020
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "20260526"
        }
    ]
}

Affected versions

Other
20170724
20170809
20170919
20171017
20171225
20180129
20180314
20180427
20180704
20180830
20181228
20190320
20190611
20190908
20191113
20200106
20200226
20200413
20200616
20200727
20200916
20201208
20201218
20210124
20210322
20210507
20210525
20210720
20211122
20211208
20220216
20220420
20220701
20220721
20220729
20221128
20230223
20230517
20230816
20231027
20240102
20240410
20240820
20241226
20250428
20250503
20250916
20260113
20260526

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-50144-103a1a0e",
        "target": {
            "function": "ParamDict::load_param",
            "file": "src/paramdict.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "171297044334995494663078596060466133510",
            "length": 3618.0
        },
        "signature_version": "v1",
        "source": "https://github.com/tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-50144-1def21a3",
        "target": {
            "file": "src/paramdict.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181853437630716551010737920368319553457",
                "299637648197898981894720791795991685189",
                "299458721291546431739895988765752750296",
                "108422265294207834176307630156347872400",
                "181853437630716551010737920368319553457",
                "299637648197898981894720791795991685189",
                "299458721291546431739895988765752750296",
                "108422265294207834176307630156347872400"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-50144-8c88893a",
        "target": {
            "function": "ParamDict::load_param_bin",
            "file": "src/paramdict.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "246336981704188830382479758241099552672",
            "length": 2403.0
        },
        "signature_version": "v1",
        "source": "https://github.com/tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020",
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50144.json"
vanir_signatures_modified 
"2026-08-12T16:09:42Z"