---
id: "CVE-2026-116608"
kind: "vulnerability"
aliases: ["CVE-2026-116608"]
title: "VideoLLaMA2: model loader skips integrity check on attacker-chosen model path"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-models", "ai-tooling", "python", "videollama2"]
not_affected_if: ["fixed-model-path", "no-user-controlled-input", "not-using-videollama2"]
published_at: "2026-10-27T01:19:05+00:00"
first_seen_at: "2026-10-27T01:34:33+00:00"
updated_at: "2026-10-27T01:36:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116608", "first_seen_at": "2026-10-27T01:34:33+00:00"}]
---

# VideoLLaMA2: model loader skips integrity check on attacker-chosen model path

VideoLLaMA2 up to version 1.1 has a flaw in its load_pretrained_model function, where manipulating the _name_or_path argument bypasses integrity validation when loading a model. An attacker who can supply a model path may get a tampered model or code loaded into the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed VideoLLaMA2 version is `1.1` or lower, for example with `pip show videollama2` or by reading the package version in the project.
- Look for calls to `load_pretrained_model` in `videollama2/model/__init__.py` that take a path or name from user input or config.

## Fix

- unknown; the sources say the project has not responded to the issue report yet, so no patched version is listed.
- Until a fix exists, only load models from trusted, pinned local paths and do not pass user-supplied model names into `load_pretrained_model`.

## Timeline

- 2026-10-27T01:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116608

## From the sources

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_