CVE-2026-110694

OAID Tengine versions up to 1.12.0 are vulnerable to an out-of-bounds read in the tmfile Model Loader component. The flaw exists in the get_tm_file_model function within the file source/serializer/tmfile/tm2_serializer.c due to improper handling of the offset_root argument. This vulnerability can...