CVE-2026-110694

OAID Tengine versions up to 1.12.0 are vulnerable to an out-of-bounds read in the tmfile Model Loader component. The flaw exists in the get_tm_file_model function within the file source/serializer/tmfile/tm2_serializer.c due to improper handling of the offset_root argument. This vulnerability can...

CVE-2026-110694: Out-of-bounds Read

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

OAID Tengine buffer error vulnerability

OAID Tengine versions 1.12.0 and earlier have a buffer error vulnerability. This vulnerability stems from the incorrect handling of the offsetroot parameter in the gettmfilemodel function of the tmfile Model Loader component, located in the source/serializer/tmfile/tm2serializer.c file. This allo...