CVE-2026-50144: ncnn out-of-bounds heap write in param loading from malicious .param file

Summary

CVE-2026-50144 affects ncnn, a neural network inference framework for mobile platforms, in commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier. When Net::load_param() loads a malicious .param model file, ncnn::ParamDict::load_param() performs an out-of-bounds heap write, because the parsed parameter id is only checked against id >= NCNN_MAX_PARAM_COUNT, so a negative id indexes before the params[NCNN_MAX_PARAM_COUNT] array.

Mitigation

This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

Related items

• InfoResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six DaysSimilar attack · The Hacker News
• MediumAn AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.Similar attack · The Hacker News
• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer