Code Injection Vulnerability in Sony Neural Network Libraries NNP Converter
CVE-2026-116104

5.3MEDIUM

Key Information:

Vendor: Sony
Status: Neural Network Libraries
Vendor: CVE Published:; 26 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-116104?

A security flaw has been identified in Sony Neural Network Libraries, specifically affecting the NNP Converter component. The vulnerability resides in the func_set_nnabla_version_decorate function located in the python/src/nnabla/utils/converter/utils.py file. By manipulating the function.type argument, an attacker could execute arbitrary code. This vulnerability can be exploited remotely, posing significant risks to users, especially as it affects products that are no longer supported by the vendor. Attention is urgently needed to mitigate potential attacks, as the exploit has been publicly released.

Affected Version(s)

Neural Network Libraries 1.0

Neural Network Libraries 1.1

Neural Network Libraries 1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-116104 - Proof of Concept