Nixpkgs security tracker

Published

Permalink CVE-2026-50144

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored
3 packages
- upscayl-ncnn
- realcugan-ncnn-vulkan
- realesrgan-ncnn-vulkan
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

References

https://github.com/Tencent/ncnn/security/advisories/GHSA-jxmc-3mv6-7pwr x_refsource_CONFIRM
https://github.com/Tencent/ncnn/commit/5a0288f255daa6c3294f77109f67718e434ec020 x_refsource_MISC

Affected products

ncnn

==< 5a0288f255daa6c3294f77109f67718e434ec020
==<= 20260526

Matching in nixpkgs

pkgs.ncnn

Neural network inference framework

nixos-unstable 20250503
- nixpkgs-unstable 20250503
- nixos-unstable-small 20250503
nixos-26.05 20250503
- nixos-26.05-small 20250503
- nixpkgs-26.05-darwin 20250503

Ignored packages (3)

pkgs.upscayl-ncnn

Upscayl backend powered by the NCNN framework and Real-ESRGAN architecture

nixos-unstable 20240601-103425
- nixpkgs-unstable 20240601-103425
- nixos-unstable-small 20240601-103425
nixos-26.05 20240601-103425
- nixos-26.05-small 20240601-103425
- nixpkgs-26.05-darwin 20240601-103425

pkgs.realcugan-ncnn-vulkan

Real-cugan converter ncnn version, runs fast on intel / amd / nvidia / apple-silicon GPU with vulkan

nixos-unstable 20220728
- nixpkgs-unstable 20220728
- nixos-unstable-small 20220728
nixos-26.05 20220728
- nixos-26.05-small 20220728
- nixpkgs-26.05-darwin 20220728

pkgs.realesrgan-ncnn-vulkan

NCNN implementation of Real-ESRGAN. Real-ESRGAN aims at developing Practical Algorithms for General Image Restoration

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0
nixos-26.05 0.2.0
- nixos-26.05-small 0.2.0
- nixpkgs-26.05-darwin 0.2.0

Package maintainers

@TilCreator TilCreator <contact.nixos@tc-j.de>

Suggestions search