CVE-2026-110657 in nnef

Resumen

por MITRE • 2026-10-14

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: VulnCheck
• Reservar: 2026-10-14
• Divulgación: 2026-10-14
• Moderación: aceptado
• Artículo: VDB-419958
• CPE: 20261014
• CWE: CWE-22 (confirmado)
• CVSS: 3.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-110657
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110657
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-110657/