CVE-2026-116104
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw was found in Sony Neural Network Libraries up to 1.39.0 affecting the func_set_nnabla_version_decorate function in python/src/nnabla/utils/converter/utils.py (NNP Converter component). Manipulating the function.type argument leads to code injection, and the attack can be launched remotely. The exploit has been publicly released and the vendor did not respond to the disclosure.
Risk Assessment
Potential remote code execution in the context of applications using the vulnerable library, possibly leading to system compromise. Since the exploit is public, the likelihood of abuse is high.
Recommendation
Update or retire the vulnerable library version, as the product is no longer supported by the maintainer. Until migration, restrict network access to the NNP conversion functionality.
Other vulnerabilities in Sony Neural Network Libraries
Original NVD description (English source)
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS