CVE-2026-110657 in nnef
Summary
by MITRE • 10/15/2026
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The Khronos NNEF-Tools library, specifically versions through 1.0.10 for nnef and 1.0.11 for nnef-tools, contains a critical path traversal vulnerability that compromises the integrity of file system operations during neural network model processing. This flaw resides in the handling of variable labels within Neural Network Exchange Format files, commonly referred to as graph.nnef. The vulnerability arises because the software fails to adequately sanitize or validate input paths before using them for file I/O operations. When a user initiates processes such as converting, saving, or generating weights from an NNEF model, the application directly incorporates variable labels into file path constructions without checking for directory traversal sequences like ../ or absolute path indicators. This lack of validation allows malicious actors to manipulate the intended destination of written files, effectively bypassing the expected sandboxing within the designated model directory.
From a technical perspective, this issue is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The root cause lies in insufficient input validation where user-controlled data from the NNEF file structure is used directly in system calls that write binary weight files with .dat extensions. By injecting relative path traversal sequences or absolute paths into variable labels, an attacker can redirect these writes to arbitrary locations on the host filesystem. This capability transforms a standard model conversion utility into a potential vector for unauthorized file creation and modification. The vulnerability exploits the trust placed in the input format by assuming that all content within the NNEF structure is benign and correctly scoped to the application's working directory, an assumption that does not hold when dealing with untrusted or maliciously crafted inputs.
The operational impact of this vulnerability extends beyond simple data corruption. An attacker who can supply a crafted graph.nnef file can overwrite critical system files, configuration settings, or other sensitive data located outside the model directory. If the application is executed with elevated privileges, such as root or administrator rights, the consequences are significantly more severe, potentially leading to full system compromise through privilege escalation techniques. Even in standard user contexts, overwriting specific .dat files could disrupt subsequent machine learning workflows by corrupting weight data or injecting malicious logic into downstream processes that consume these weights. This represents a significant risk for environments where model conversion is automated or performed on behalf of other users without rigorous input sanitization protocols.
To mitigate this vulnerability, organizations should immediately update the Khronos NNEF-Tools to patched versions beyond 1.0.10 and 1.0.11, which address these path validation issues. In cases where updating is not immediately feasible, defensive coding practices must be implemented by developers integrating the library. This includes strictly validating all variable labels against a whitelist of allowed characters and ensuring that resolved file paths remain within the expected base directory using canonicalization techniques before any write operations occur. Additionally, running model conversion tools with least-privilege principles can limit the blast radius if an exploit is attempted. Security teams should also monitor for unusual file creation patterns in directories associated with neural network processing pipelines to detect potential exploitation attempts early. This vulnerability aligns with ATT&CK technique T1048: Exfiltration Over Alternative Protocol, as it allows attackers to manipulate files that could be used for further data exfiltration or persistence mechanisms within the target environment.