CVE-2026-110694 Details

A heap-based buffer overflow vulnerability has been identified in OAID Tengine versions through 1.12.0. The issue arises in the TMFile Model Loader component, specifically within the 'get_tm_file_model' function of 'source/serializer/tmfile/tm2_serializer.c'. The vulnerability is triggered by unvalidated offsets from the TM2_Header, leading to out-of-bounds memory access. This flaw can be exploited remotely, causing a denial-of-service condition by crashing the application. Furthermore, the out-of-bounds read can be leveraged to manipulate in-memory graph structures, potentially leading to more severe consequences.

It is recommended to validate the offset values in the TMFile Model Loader before using them to ensure they do not exceed the allocated memory buffer. This can be done by checking that the offset plus the size of the minimum structure does not exceed the total memory length.