CVE-2026-116608: VideoLLaMA2: unverified model integrity on load

MEDIUM

Published October 27, 2026

CISO Take

CVE-2026-116608 is a medium-severity (CVSS 5.4) integrity-validation flaw in VideoLLaMA2's load_pretrained_model function, where a manipulated _name_or_path argument lets the loader accept model artifacts without properly verifying their integrity. It is not in CISA KEV, has no EPSS score yet and no scanner template, but a public exploit write-up exists in the project's GitHub issue and the maintainers have not responded, so no patch should be expected soon. The package has 1,841 downstream dependents and 40 other CVEs on record, which signals weak security hygiene and a wide supply-chain footprint for any team consuming it. Pin model sources to trusted, hash-verified local copies, block loading of models from untrusted repos or paths, and monitor the upstream issue (DAMO-NLP-SG/VideoLLaMA2#182) for a fix.

Sources:NVDATLASVulDB

What is the risk?

Medium overall. The CVSS vector (AV:N/AC:L/PR:N/UI:R, I:L/A:L) shows network reach and low complexity but requires user interaction, such as a victim loading an attacker-chosen model path. Impact is limited to low integrity and availability, with no confidentiality loss in the scoring. Exploit maturity is rated proof-of-concept, with details public and no vendor response, so the exposure window is open-ended. Risk rises where model identifiers come from user input, config files, or automated pipelines. The scoring does not account for downstream consequences of running a tampered model, which could be higher than the base score implies.

How does the attack unfold?

Initial Access

Attacker supplies or hosts a tampered model and induces a user or pipeline to pass its path via _name_or_path.

AML.T0010.003

Exploitation

load_pretrained_model accepts the artifact without a valid integrity check, so the altered weights are loaded.

AML.T0018.000

Impact

The tampered model returns manipulated outputs or degrades inference availability for downstream consumers.

AML.T0031

Initial Access

Attacker supplies or hosts a tampered model and induces a user or pipeline to pass its path via _name_or_path.

AML.T0010.003

Exploitation

load_pretrained_model accepts the artifact without a valid integrity check, so the altered weights are loaded.

AML.T0018.000

Impact

The tampered model returns manipulated outputs or degrades inference availability for downstream consumers.

AML.T0031

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
184.7K1.8K dependentsPushed 7d ago19% patched~29d to patchFull package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

ILow

ALow

What should I do?

7 steps

No patched version is listed, so track upstream issue #182 and the vendor repo for a fix.
Download model weights from trusted sources only, verify SHA-256 hashes against published values, and load from local read-only paths rather than dynamic identifiers.
Do not let untrusted users or external config control the _name_or_path argument.
Prefer safetensors checkpoints and enforce an allowlist of approved model repos.
Run inference in isolated containers with restricted network egress and least privilege.
Detect unexpected model file changes with file integrity monitoring and log model load events with source and hash.
Consider an internal fork with an added integrity check until upstream responds.

How is it classified?

Supply ChainModel PoisoningModelInferenceFrameworkAML.T0010.003- Model AML.T0018.000- Poison AI Model AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies for third-party AI risk

OWASP LLM Top 10

LLM03-Supply ChainLLM04-Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-116608?

Is CVE-2026-116608 actively exploited?

No confirmed active exploitation of CVE-2026-116608 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116608?

1. No patched version is listed, so track upstream issue #182 and the vendor repo for a fix. 2. Download model weights from trusted sources only, verify SHA-256 hashes against published values, and load from local read-only paths rather than dynamic identifiers. 3. Do not let untrusted users or external config control the _name_or_path argument. 4. Prefer safetensors checkpoints and enforce an allowlist of approved model repos. 5. Run inference in isolated containers with restricted network egress and least privilege. 6. Detect unexpected model file changes with file integrity monitoring and log model load events with source and hash. 7. Consider an internal fork with an added integrity check until upstream responds.

What systems are affected by CVE-2026-116608?

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference pipelines, model loading and registry workflows, fine-tuning pipelines.

What is the CVSS score for CVE-2026-116608?

CVE-2026-116608 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

model servingmultimodal inference pipelinesmodel loading and registry workflowsfine-tuning pipelines

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0018.000Poison AI Model

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03, LLM04

What are the technical details?

Original Advisory

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a modified VideoLLaMA2 checkpoint, or tampers with a mirrored or cached copy, then persuades a developer or an automated workflow to load it by supplying a crafted _name_or_path value, for example through a shared config, tutorial, or web demo parameter. Because load_pretrained_model does not properly validate integrity, the altered weights load without warning. The compromised model then produces manipulated video analysis results or causes instability, undermining downstream decisions that rely on its output.

Weaknesses (CWE)

CWE-345Insufficient Verification of Data Authenticity CWE-354Improper Validation of Integrity Check Value

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.