{"id":"CVE-2026-116608","state":"PUBLISHED","title":"DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check","description":"A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","publishedAt":"2026-10-27T00:15:18.298Z","updatedAt":"2026-10-27T00:15:18.298Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["DAMO Academy VideoLLaMA2"],"affected":[{"vendor":"DAMO Academy","product":"VideoLLaMA2","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"}],"cpes":["cpe:2.3:a:damo_academy:videollama2:*:*:*:*:*:*:*:*"],"modules":["Model Loading"]}],"references":["https://vuldb.com/vuln/426516","https://vuldb.com/vuln/426516/cti","https://vuldb.com/cve/CVE-2026-116608","https://vuldb.com/submit/1022955","https://github.com/DAMO-NLP-SG/VideoLLaMA2/issues/182"],"weaknesses":["CWE-354","CWE-345"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/116xxx/CVE-2026-116608.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116608","state":"PUBLISHED","datePublished":"2026-10-27T00:15:18.298Z","dateUpdated":"2026-10-27T00:15:18.298Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-10-26T16:12:07.200Z"},"containers":{"cna":{"title":"DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"vendor":"DAMO Academy","product":"VideoLLaMA2","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"}],"cpes":["cpe:2.3:a:damo_academy:videollama2:*:*:*:*:*:*:*:*"],"modules":["Model Loading"]}],"references":[{"url":"https://vuldb.com/vuln/426516","name":"VDB-426516 | DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/426516/cti","name":"VDB-426516 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-116608","name":"CVE-2026-116608 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/1022955","name":"Submit #1022955 | DAMO-NLP-SG VideoLLaMA2 commit c0bb03abf6b8a6b9a8dccac006fb4db5d4d9e414 (main HEAD) and tag v1.1 Download of Code Without Integrity Check","tags":["third-party-advisory"]},{"url":"https://github.com/DAMO-NLP-SG/VideoLLaMA2/issues/182","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.4,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-354","type":"CWE","lang":"en","description":"Improper Validation of Integrity Check Value"}]},{"descriptions":[{"cweId":"CWE-345","type":"CWE","lang":"en","description":"Insufficient Verification of Data Authenticity"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-27T00:15:18.298Z"},"timeline":[{"time":"2026-10-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-10-26T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-26T17:17:12.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Dem00000 (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202610"]}}}}