CVE-2026-116104: Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function funcsetnnablaversiondecorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Sony Neural Network Libraries NNP Converter deployments using versions up to 1.39.0 are affected. The issue is limited to products that are no longer supported by the maintainer.
What does an attacker need to exploit this issue?
An attacker needs to manipulate the function.type argument processed by func_set_nnabla_version_decorate in python/src/nnabla/utils/converter/utils.py. The attack can be initiated remotely and requires user interaction according to the supplied vector.
Is exploit code available?
Yes. A public exploit has been released and may be used in attacks.
What can be done if patching is not available?
The affected products are no longer supported, and the vendor did not respond to the disclosure. No workaround or fixed version is provided in the available data.