CVE-2026-110694

MEDIUM 6.3

OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-125 CWE-119
Vendor	oaid
Product	tengine
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for oaid tengine

Be the first to know when new medium vulnerabilities affecting oaid tengine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

OAID / Tengine

1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/419841 vuldb.com: https://vuldb.com/vuln/419841/cti vuldb.com: https://vuldb.com/cve/CVE-2026-110694 vuldb.com: https://vuldb.com/submit/1003957 github.com: https://github.com/OAID/Tengine/issues/1453 github.com: https://github.com/OAID/Tengine/

Credits

🔍 r1ck99 (VulDB User) VulDB CNA Team