CVE-2026-110657: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Khronos Group nnef

CVE-2026-110657 is a path traversal vulnerability in Khronos Group's NNEF-Tools nnef (up to version 1.0.10) and nnef-tools (up to version 1.0.11). The vulnerability arises because the software does not properly restrict pathname inputs, allowing attackers to supply crafted variable labels with directory traversal sequences or absolute paths. This enables the creation or overwriting of '.dat' files outside the intended model directory during operations such as conversion, saving, or weight generation.

An attacker can write or overwrite files outside the designated model directory, potentially leading to unauthorized file modification or data corruption. The CVSS 4.8 (medium severity) indicates limited attack vector (local), low complexity, no privileges required, and user interaction needed. There is no indication of remote exploitation or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted graph.nnef files and validate input labels to prevent directory traversal sequences.