A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1.
CVE-2026-116608
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function loadpretrainedmodel of the file videollama2/model/init.py of the component Model Loading. The manipulation of the argument nameorpath leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Assessment
- CVSS
- 2.1 (v4.0)
- Severity
- Low
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Weakness
- CWE-345, CWE-354
- Assigner
- cna@vuldb.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116608