CVE-2026-116103mediumCWE-74CWE-94

CVE-2026-116103: medium-severity vulnerability in Sony Neural Network Libraries

Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection

Published · Updated

Follow this CVE+ Monitor Neural Network Libraries

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Sony · Neural Network Libraries
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sony Neural Network Libraries

In the same product, most dangerous first.

CVE-2026-116104MEDIUMSony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injectionEPSS 0.2%