EUVD-2026-110566
GHSA-98hf-f439-379p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperator loads attacker-supplied _name_or_path
-
ExploitIntegrity check value not validated
-
ExecutionTampered model artifact loaded
-
ImpactLow integrity and availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Integrity verification
|
| Exploitation Conditions | Exploitation requires that the application or an integration calls the vulnerable load_pretrained_model function in videollama2/model/__init__.py with an attacker-controlled _name_or_path, and that the model-loading path fails to properly validate the integrity check value (CWE-354), allowing a tampered model artifact to be accepted. The key limiting factor is passive user interaction (UI:P): an operator must initiate loading of a model from an attacker-influenced source/path - this is a library function invoked by the user, not an always-on remote service, so there is no default remote-unauthenticated exposure. Impact is bounded to low integrity and low availability (VI:L/VA:L) with no confidentiality impact. |
| Impact | All available signals point to a low real-world priority. The CVSS 4.0 base score is 2.1 (Low): network vector (AV:N) and low complexity (AC:L) with no privileges (PR:N), but passive user interaction is required (UI:P) and impact is limited to low integrity and low availability (VI:L/VA:L) with no confidentiality impact (VC:N). EPSS is 0.15% (4th percentile), among the lowest exploitation-probability bands. The vulnerability is NOT on the CISA KEV list, and the vuln.today decision label is 'monitor' - the lowest urgency tier. The PoC is a reference only (a project GitHub issue), not verified as working exploit code, so active exploitation is not indicated. One inconsistency to note: the input Tags include 'Information Disclosure', yet the CVSS vector explicitly sets VC:N (no confidentiality impact) and the CWE is CWE-354 (improper validation of integrity check value) - the labeled impact category conflicts with the scored impact and should be treated as a mislabel, not evidence of data exposure. Net: this is a genuinely low-risk, low-severity issue, not a high-CVSS/low-real-risk case, and it warrants monitoring rather than emergency action. |
| Exploit ScenarioDerived | An operator or downstream integration invokes load_pretrained_model with an attacker-influenced _name_or_path value; because the function does not properly validate the integrity check value (CWE-354), a tampered model artifact can be loaded, producing limited integrity and availability impact. A public PoC reference exists (the DAMO-NLP-SG/VideoLLaMA2 GitHub issue #182); it is not verified as working exploit code. Exploitation requires passive user interaction (UI:P), meaning a user must initiate the model-loading action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Improper validation of an integrity check value in VideoLLaMA2's model-loading routine (load_pretrained_model in videollama2/model/__init__.py) allows a tampered model artifact to be accepted when an operator loads a model from an attacker-influenced path supplied through the _name_or_path argument. Versions 1.0 and 1.1 are affected; because the flaw lives in a library function rather than an always-on service, exploitation requires passive user interaction - someone must actively initiate a load from the hostile source - and impact is bounded to low integrity and low availability with no confidentiality effect. A public reference to the issue exists (the upstream GitHub issue report), but it is not verified as working exploit code, there is no CISA KEV listing, and EPSS is 0.15% (4th percentile), so all available signals point to a low real-world priority and a monitor-level decision.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the project had not responded to the early issue report, so there is no fixed version to cite for either the 1.0 or 1.1 branch; track https://github.com/DAMO-NLP-SG/VideoLLaMA2/issues/182 and the VulDB entry for a maintainer fix. Until an upstream fix lands, the practical compensating control is to restrict model loading to trusted, locally controlled checkpoint paths - never pass an attacker-influenced or externally sourced value as _name_or_path, and verify checkpoint hashes or signatures out-of-band before calling load_pretrained_model; the trade-off is manual provenance bookkeeping and reduced convenience for pulling upstream model weights. Wrapping the loader so that _name_or_path is validated against an allowlist of approved repositories or directories limits exposure but must be maintained as model sources change, and because the flaw is only reachable when an operator initiates a load, treating model artifacts as untrusted input in any integration or service that proxies the loader removes the residual risk without a code change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the model-loading machinery of DAMO Academy's VideoLLaMA2, a video-capable large multimodal model repository, specifically the load_pretrained_model function in videollama2/model/__init__.py. The root cause class is CWE-354, improper validation of an integrity check value: when a pretrained checkpoint is resolved through the _name_or_path argument, the code does not adequately verify the integrity of the artifact it accepts, so a modified model file can pass as legitimate. The supplied evidence does not describe the exact integrity check that is bypassed, nor the precise file format or hashing mechanism involved, so the trigger mechanics beyond the attacker-influenced _name_or_path path are not described in the available sources. Critically, this is a library entry point invoked by the user or by an integration that wraps it - it is not a network-facing daemon - which is why the CVSS 4.0 scoring (2.1, AV:N/AC:L/AT:N/PR:N/UI:P with E:P) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) both hinge on required user interaction and confine impact to low integrity and low availability with no confidentiality loss.
Know when Videollama2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Model reference is fetched over the network (AV:N) and an operator must trigger loading (UI:R); no auth needed (PR:N); integrity-check bypass yields limited integrity/availability impact and no confidentiality impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB