The vulnerability occurs in the function get_tm_file_model within the tmfile Model Loader component of OAID Tengine. An attacker may manipulate the offset_root argument so that the function performs a reading beyond the bounds of the intended buffer. This out-of-bounds read can expose data located in memory that is not part of the intended output, potentially leaking sensitive information. The CVE description notes that the issue is exploitable remotely and has been publicly disclosed.

All OAID Tengine releases up to and including version 1.12.0 are affected. Systems running any version equal to or older than 1.12.0 must be evaluated for vulnerability, as there is no indication that later versions are patched in the provided data.

The CVSS score of 5.3 reflects moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. However, the attack vector is remote and the exploit has been publicly disclosed, meaning that an adversary with network access to a Tengine instance could trigger the out-of-bounds read at any time. Although no widespread exploitation evidence is presented, the combination of remote availability and potential data exposure warrants a prompt response.