CVE-2026-50144: ncnn Buffer Overflow Vulnerability

CVE-2026-50144 Overview

CVE-2026-50144 is an out-of-bounds heap write vulnerability in ncnn, a high-performance neural network inference framework developed by Tencent and optimized for mobile platforms. The flaw resides in ncnn::ParamDict::load_param(), which is invoked when Net::load_param() parses a .param model file. The parser validates the parsed parameter id only against the upper bound id >= NCNN_MAX_PARAM_COUNT, but not against negative values. A crafted .param file supplying a negative id writes before the params[NCNN_MAX_PARAM_COUNT] array, corrupting adjacent heap memory. The issue is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Loading a malicious .param model file can corrupt heap memory in the host process, resulting in integrity and availability loss for any application embedding a vulnerable ncnn build.

Affected Products

Tencent ncnn at commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier
Applications and mobile SDKs that embed vulnerable ncnn builds
Downstream projects consuming ncnn as a static or shared library

Discovery Timeline

2026-07-15 - CVE-2026-50144 published to NVD
2026-07-15 - Last updated in NVD database
Fix commit - 5a0288f255daa6c3294f77109f67718e434ec020 merged to the ncnn repository

Technical Details for CVE-2026-50144

Vulnerability Analysis

The ncnn parameter dictionary loader reads integer parameter identifiers from a .param text file. Certain parameter formats trigger a transform id = -id - 23300, allowing the resulting value to become negative when attacker-controlled input is supplied. The subsequent bounds check compares only the upper limit before the identifier is used as an array index. When the value is negative, the write targets memory located before the fixed-size params array on the heap-allocated ParamDict object. This produces an out-of-bounds heap write whose offset and content are influenced by the model file.

Root Cause

The root cause is a missing lower-bound check on the parsed parameter identifier in src/paramdict.cpp. The original conditional if (id >= NCNN_MAX_PARAM_COUNT) guards only against overflow past the array end. Negative indices bypass this check entirely, allowing arbitrary underflow indexing into params[id]. The fix commit adds the missing id < 0 guard.

Attack Vector

Exploitation requires a local user to load a malicious .param file through Net::load_param(). The CVSS vector AV:L/AC:L/PR:N/UI:R reflects that user interaction is needed to supply the model file, but no privileges are required. Because ncnn is commonly embedded in mobile apps, desktop AI tools, and on-device inference pipelines, delivery paths include model marketplaces, shared model repositories, and applications that automatically load user-supplied models.

cpp

// Patch from src/paramdict.cpp (Tencent/ncnn)
            id = -id - 23300;
        }

-        if (id >= NCNN_MAX_PARAM_COUNT)
+        if (id < 0 || id >= NCNN_MAX_PARAM_COUNT)
        {
            NCNN_LOGE("id < NCNN_MAX_PARAM_COUNT failed (id=%d, NCNN_MAX_PARAM_COUNT=%d)", id, NCNN_MAX_PARAM_COUNT);
            return -1;
// Source: https://github.com/Tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020

Detection Methods for CVE-2026-50144

Indicators of Compromise

.param files containing parameter identifiers that decode to negative values after the -id - 23300 transform
Process crashes or heap corruption abort messages originating from applications linked against ncnn
Log entries containing id < NCNN_MAX_PARAM_COUNT failed emitted by patched builds when malicious files are rejected

Detection Strategies

Inventory build artifacts and container images for ncnn versions at or before commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 using software composition analysis.
Statically scan .param files ingested by production pipelines for lines whose parsed identifier is outside [0, NCNN_MAX_PARAM_COUNT).
Enable AddressSanitizer or heap-hardening allocators in test environments to surface out-of-bounds writes during model ingestion tests.

Monitoring Recommendations

Alert on unexpected termination or SIGABRT of processes that load user-supplied AI models.
Monitor endpoint telemetry for applications reading .param files from untrusted paths such as downloads, shared storage, or removable media.
Track outbound and inbound traffic to model-sharing hubs to identify sources of untrusted model files entering the environment.

How to Mitigate CVE-2026-50144

Immediate Actions Required

Upgrade ncnn to a build that includes commit 5a0288f255daa6c3294f77109f67718e434ec020 or later.
Rebuild and redistribute any downstream applications, SDKs, or mobile apps that statically link the vulnerable ncnn version.
Restrict Net::load_param() inputs to model files sourced from trusted, integrity-verified locations.

Patch Information

The vulnerability is fixed by adding a lower-bound check to the parameter identifier validation in src/paramdict.cpp. Review the GitHub Commit Changes and the GitHub Security Advisory GHSA-jxmc-3mv6-7pwr for full patch context. Consumers of ncnn should pin to the fixed revision and rerun their model-loading regression tests.

Workarounds

Validate .param files before loading by parsing identifiers and rejecting any negative or out-of-range values.
Isolate model-loading logic in a sandboxed process or container with restricted filesystem and IPC access to contain heap corruption impact.
Disable automatic loading of user-supplied .param files in end-user applications until patched binaries are deployed.

bash

# Quick pre-load validation for .param files
# Rejects files whose first-column ids fall outside [0, NCNN_MAX_PARAM_COUNT)
NCNN_MAX_PARAM_COUNT=32
awk -v max="$NCNN_MAX_PARAM_COUNT" '
  NR>2 {
    for (i=2; i<=NF; i++) {
      split($i, kv, "=");
      id = kv[1] + 0;
      if (id < 0 || id >= max) { print "REJECT: " FILENAME; exit 1 }
    }
  }
' model.param && echo "OK: model.param"