CVE-2026-116104

Received Received - Intake

Code Injection in Sony Neural Network Libraries

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description

A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-26

AI Q&A

2026-10-26

EPSS Evaluated

N/A

NVD

CVE-2026-116104

EUVD

EUVD-2026-109592

Affected Vendors & Products

Vendor	Product	Version / Range
Sony	Neural Network Libraries	1.0
Sony	Neural Network Libraries	1.1
Sony	Neural Network Libraries	1.2
Sony	Neural Network Libraries	1.3
Sony	Neural Network Libraries	1.4
Sony	Neural Network Libraries	1.5
Sony	Neural Network Libraries	1.6
Sony	Neural Network Libraries	1.7
Sony	Neural Network Libraries	1.8
Sony	Neural Network Libraries	1.9
Sony	Neural Network Libraries	1.10
Sony	Neural Network Libraries	1.11
Sony	Neural Network Libraries	1.12
Sony	Neural Network Libraries	1.13
Sony	Neural Network Libraries	1.14
Sony	Neural Network Libraries	1.15
Sony	Neural Network Libraries	1.16
Sony	Neural Network Libraries	1.17
Sony	Neural Network Libraries	1.18
Sony	Neural Network Libraries	1.19
Sony	Neural Network Libraries	1.20
Sony	Neural Network Libraries	1.21
Sony	Neural Network Libraries	1.22
Sony	Neural Network Libraries	1.23
Sony	Neural Network Libraries	1.24
Sony	Neural Network Libraries	1.25
Sony	Neural Network Libraries	1.26
Sony	Neural Network Libraries	1.27
Sony	Neural Network Libraries	1.28
Sony	Neural Network Libraries	1.29
Sony	Neural Network Libraries	1.30
Sony	Neural Network Libraries	1.31
Sony	Neural Network Libraries	1.32
Sony	Neural Network Libraries	1.33
Sony	Neural Network Libraries	1.34
Sony	Neural Network Libraries	1.35
Sony	Neural Network Libraries	1.36
Sony	Neural Network Libraries	1.37
Sony	Neural Network Libraries	1.38
Sony	Neural Network Libraries	1.39.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in Sony Neural Network Libraries up to version 1.39.0. It occurs in the NNP Converter component, specifically in the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py. Attackers can manipulate the function.type argument to inject malicious code, which gets executed via Python's eval() function during model conversion. The exploit requires a crafted .nnp file with duplicate network names and a malicious function.type payload.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Sony Neural Network Libraries version 1.39.0 and inspecting files for unsafe eval() usage in the NNP converter component. Look for the file python/src/nnabla/utils/converter/utils.py and review functions func_set_nnabla_version_decorate and func_set_import_nnp for eval() calls on user-controlled input.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your system with the privileges of the user running the NNP converter. An attacker could create files, install malware, or perform other malicious actions. The exploit is triggered simply by converting a specially crafted .nnp file, which may be distributed through phishing or other social engineering methods.

Compliance Impact

This vulnerability allows arbitrary code execution on systems using affected Sony Neural Network Libraries versions. For GDPR, it could lead to unauthorized access to personal data, violating confidentiality and integrity requirements. For HIPAA, it may enable unauthorized access to protected health information, compromising security controls.

Mitigation Strategies

Immediately stop using Sony Neural Network Libraries version 1.39.0 or older. Avoid converting .nnp files from untrusted sources. Replace eval() calls with safe attribute lookups and validate function types against known types. Enforce network name uniqueness in .nnp files.

Hi! I’m here to help you understand CVE-2026-116104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

Code Injection in Sony Neural Network Libraries

Description

CVSS Scores

EPSS Scores

Meta Information

Affected Vendors & Products

Helpful Resources

Exploitability

Attack-Flow Graph

AI Quick Actions

Chat Assistant

EPSS Chart