CVE-2026-116103
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 affecting the load_param_in_txt function in python/src/nnabla/utils/cli/encode_decode_param.py (Encode Param Command Handler component). Manipulation leads to code injection, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond to the disclosure.
Risk Assessment
Remote code injection may allow an attacker to execute arbitrary commands in the tool user's environment. Public exploit availability increases the risk of real-world attacks.
Recommendation
Update or retire the vulnerable library version, as it is no longer supported. Restrict access to the parameter encode/decode CLI commands to trusted users.
Other vulnerabilities in Sony Neural Network Libraries
Original NVD description (English source)
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS