CVE-2026-116608

VideoLLaMA2 checkpoint metadata silently redirects model downloads

DAMO Academy · VideoLLaMA2 model loading

First documented disclosure · Review checkpoint

Summary

Opening a crafted pretraining checkpoint can silently fetch an attacker-selected tokenizer and model weights.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources establish a vulnerability and controlled reproduction, not real-world malicious exploitation. CISA KEV 2026.10.27 contains no exact-ID match; absence is not proof of no exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The loader trusts config.json _name_or_path as a remote base repository instead of preserving the selected local origin.

Conditions required

An operator loads an untrusted pretraining checkpoint without an explicit model_base, and the loader can reach the substituted repository.

Potential impact

Model integrity can be compromised through substituted data-only weights; code execution or upload of victim data is not demonstrated.

Affected versions and configurations

CNA lists 1.0 and 1.1. The researcher verified tag v1.1 and commit c0bb03ab; v1.0 was not assessed because its layout differs.

Fix and mitigation status

No fixed release established in the reviewed sources.

Practical next steps

Use trusted checkpoints with an explicitly approved model_base; validate and pin every remote model origin before loading.

Operating lesson

Model metadata must not silently choose a second download trust boundary.

Evidence and limits

The public issue dates to October10; the October27 CVE is later. Its internal October6 test note is not treated as public disclosure. The CNA Medium5.3 rating differs from the researcher’s High 7.1 assessment.

Sources