---
id: CVE-2026-116608
title: >-
  DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model
  integrity check
summary: >-
  A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to
  1.1. Affected by this issue is the function load_pretrained_model of the file
  videollama2/model/__init__.py of the component Model Loading. The manipulation
  of …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-354
  - CWE-345
vendor: DAMO Academy
product: VideoLLaMA2
affected:
  - VideoLLaMA2 1.0
  - VideoLLaMA2 1.1
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T00:15:18.298Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116608'
references:
  - url: 'https://vuldb.com/vuln/426516'
    label: >-
      VDB-426516 | DAMO Academy VideoLLaMA2 Model Loading __init__.py
      load_pretrained_model integrity check
  - url: 'https://vuldb.com/vuln/426516/cti'
    label: 'VDB-426516 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116608'
    label: CVE-2026-116608 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022955'
    label: >-
      Submit #1022955 | DAMO-NLP-SG VideoLLaMA2 commit
      c0bb03abf6b8a6b9a8dccac006fb4db5d4d9e414 (main HEAD) and tag v1.1 Download
      of Code Without Integrity Check
  - url: 'https://github.com/DAMO-NLP-SG/VideoLLaMA2/issues/182'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.04145
ingestedAt: '2026-10-27T16:11:59.172Z'
---

## Overview

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `VideoLLaMA2 1.0`
- `VideoLLaMA2 1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.