Khronos NNEF-Tools EUVD-2026-101130

Exploitation requires that a victim process an attacker-supplied NNEF model (a graph.nnef whose variable labels contain '../' sequences or absolute paths) by invoking a convert, save, or weight-generation operation in nnef or nnef-tools - this is the exact triggering feature. Limiting factors: the attack is local (AV:L) and requires user interaction (UI:P), so the attacker cannot act remotely or autonomously; the victim must obtain and deliberately open/process the malicious model, and impact is bounded to file paths writable by the user running the tool. No special product configuration is needed beyond normal use of the affected versions (nnef ≤1.0.10, nnef-tools ≤1.0.11).

This is a genuinely medium/low-priority issue despite a publicly available POC. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 4.8, driven by a local attack vector and required user interaction (UI:P) with only limited integrity impact (VI:L) and no confidentiality or availability impact. This is not a remote code execution primitive - it is a file write/overwrite primitive that fires only when a victim actively converts, saves, or generates weights from an attacker-supplied NNEF model. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active or widespread exploitation; the only exploitation signal is a publicly available POC (hackmd writeup) reported by VulnCheck. Signals are consistent rather than conflicting: low severity, local vector, and user-interaction dependence all point to a targeted/opportunistic social-engineering risk (malicious model file) rather than mass exploitation. The realistic concern is overwriting or planting '.dat' files outside the intended model directory, which could corrupt data or, in the worst case, overwrite files the user has write access to.

An attacker publishes or shares a malicious NNEF model whose graph.nnef contains variable labels with '../' sequences or absolute paths. When a victim loads that model and converts, saves, or generates weights using nnef/nnef-tools, the library writes '.dat' files to attacker-controlled paths outside the model directory, overwriting existing files the user can write. A public POC demonstrating the path traversal exists.