CVE-2026-110657

Deferred Deferred - Pending Action

Path Traversal in Khronos NNEF-Tools

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110657

EUVD

EUVD-2026-101130

Affected Vendors & Products

Vendor	Product	Version / Range
Khronos	Group	nnef 0
Khronos	Group	nnef-tools 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-110657 is a path traversal vulnerability in Khronos NNEF-Tools. It allows attackers to write files outside the intended model directory by exploiting crafted variable labels in NNEF files. Attackers can include sequences like '../' or absolute paths in labels, causing the system to create or overwrite '.dat' files during operations such as converting, saving, or generating weights.

Detection Guidance

Check for suspicious file writes in parent directories of model output folders. Review NNEF graph files for variable labels containing '../' or absolute paths. Monitor for unexpected '.dat' files created outside intended directories during model conversion or weight generation.

Impact Analysis

This vulnerability can lead to file corruption, tampering, or unauthorized file creation outside the intended directory. Attackers with access to craft NNEF files could overwrite system files, install malware, or escalate privileges depending on the permissions of the affected process. It may also disrupt model operations or enable further attacks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file writes outside intended directories. Attackers could create or overwrite files, potentially accessing or modifying sensitive data, which may violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update NNEF-Tools to the latest patched version if available.
Audit existing NNEF models for malicious variable labels with '../' or absolute paths.
Restrict write permissions to model directories to limit impact of potential exploits.
Implement input validation for variable labels in NNEF processing pipelines.

Hi! I’m here to help you understand CVE-2026-110657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70