CVE-2026-116608 in VideoLLaMA2
Summary
by MITRE • 10/27/2026
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in DAMO Academy VideoLLaMA2, specifically within versions up to 1.1, represents a critical integrity check bypass located in the model loading subsystem. This flaw resides within the load_pretrained_model function found in the videollama2/model/_init_.py file. The core technical issue stems from improper validation of an integrity check value when processing the _name_or_path argument. In secure software architecture, integrity checks are essential to ensure that loaded models have not been tampered with and originate from trusted sources. By failing to adequately validate this parameter, the application allows for the loading of potentially malicious or corrupted model weights without triggering appropriate security alerts or rejection mechanisms. This deficiency undermines the fundamental trust boundary between the user input and the internal state management of the deep learning framework.
From a technical perspective, the manipulation of the _name_or_path argument enables an attacker to bypass integrity verification processes that are designed to prevent code injection or arbitrary file inclusion attacks. When the validation logic is flawed, it becomes possible for remote actors to supply crafted inputs that deceive the model loading routine into accepting unverified artifacts. This type of vulnerability aligns with CWE-20 Improper Input Validation and CWE-345 Insufficient Verification of Data Authenticity as defined by industry standards. The lack of rigorous checks on file paths or identifiers allows an adversary to inject malicious payloads directly into the execution environment, potentially leading to remote code execution if the loaded model contains executable components or triggers specific inference behaviors that can be exploited for control flow hijacking.
The operational impact of this vulnerability is severe due to its potential for remote exploitation and public disclosure of exploit methods. Since VideoLLaMA2 is often deployed in cloud-based services, APIs, or automated pipelines where models are loaded dynamically based on user-provided identifiers, an attacker can remotely trigger the loading process with malicious parameters. The fact that the exploit has been disclosed publicly significantly increases the risk landscape, as it lowers the barrier to entry for less sophisticated attackers who may leverage existing proof-of-concept code. Furthermore, the project's lack of response to early issue reports suggests a potential gap in security maintenance and patch management, leaving users exposed during this window of vulnerability. This situation highlights the importance of proactive security monitoring and timely remediation in open-source AI projects that are widely adopted for production workloads.
Mitigation strategies must focus on immediate defensive measures until an official patch is released by DAMO Academy. Users should restrict model loading to trusted, verified sources and avoid passing untrusted user input directly into the _name_or_path argument without rigorous sanitization or allowlisting of permitted identifiers. Implementing strict file path validation and ensuring that integrity checks are enforced with cryptographic signatures can help mitigate this risk in custom deployments. Additionally, organizations utilizing VideoLLaMA2 should consider network-level controls such as web application firewalls to detect anomalous model loading requests and isolate affected instances from critical infrastructure. Long-term resolution requires the vendor to address the input validation logic within the load_pretrained_model function and establish a robust security response process for future vulnerability reports to maintain trust in the ecosystem.