CVE-2026-116608: DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function loadpretrainedmodel of the file videollama2/model/init.py of the component Model Loading. The manipulation of the argument nameorpath leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which versions should be treated as affected?
DAMO Academy VideoLLaMA2 versions up to and including 1.1 are affected.
Is exploit information available publicly?
Yes. The exploit has been publicly disclosed and may be used.
Does exploitation require local access?
No. The issue is described as remotely exploitable through manipulation of the _name_or_path argument.
Is a vendor fix or response available?
The project was informed through an issue report but had not responded at the time of publication. No fix or workaround is provided in the available data.