A vulnerability has been found in OAID Tengine up to 1.12.0. (CVE-2026-110694)

CVE-2026-110694 describes an out-of-bounds read vulnerability in OAID Tengine versions up to 1.12.0. The flaw exists in the get_tm_file_model function within the source/serializer/tmfile/tm2_serializer.c file, specifically in the tmfile Model Loader component. Manipulating the offset_root argument leads to an out-of-bounds read condition. The vulnerability can be exploited remotely. The project was notified early but has not issued a fix or response. The CVSS v3.1 base score is 6.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to information disclosure and potential integrity and availability impacts due to out-of-bounds memory reads. The vulnerability is remotely exploitable without privileges but requires user interaction. Public exploit details are available, increasing the risk of exploitation.

No official fix or patch has been released by the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is available, consider restricting access to vulnerable components and applying network-level protections to limit exposure. Avoid processing untrusted input that could trigger the vulnerability.