Live › vulnerability › CVE-2026-116104
Go to dashboardSony Neural Network Libraries up to version 1.39.0 has a code injection flaw in the NNP Converter, where the function.type argument is not sanitized in func_set_nnabla_version_decorate. An attacker who can supply a crafted input to the converter can get code to run on the machine processing it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 01:38 UTC. All times on this page are UTC.
Teams that run the Sony Neural Network Libraries Python package (nnabla) up to 1.39.0 and feed it NNP files or data from outside their own control, for example through a conversion service. Systems that only use the library for local training on trusted models are less exposed. The sources say the affected product is no longer supported by the maintainer.
No product ranges from the sources yet.
pip show nnabla and see whether it is 1.39.0 or oldernnabla.utils.converter to find where the NNP converter is used1.39.0 if one is available, or the sources do not say which version is fixedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-116104")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.