Bug 2555361 (CVE-2026-112074)

Summary: CVE-2026-112074 ncnn: ncnn: Denial of Service via integer overflow in yuv420sp2rgb
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in ncnn. An integer overflow vulnerability in the image format conversion component, specifically within the ncnn::yuv420sp2rgb function, allows a remote attacker to cause a Denial of Service (DoS) or memory corruption. By providing specially crafted image data for conversion, an attacker can trigger an arithmetic calculation error, leading to improper memory handling that may crash the application or disclose sensitive information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2558215    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 03:51:58 UTC 
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.