CVE-2026-116103 - Vulnerability Details

- Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection

Description

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Published: 2026-10-26

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Sony

Neural Network Libraries

affected

Version	Status	Constraints
`1.0`	affected	—
`1.1`	affected	—
`1.2`	affected	—
`1.3`	affected	—
`1.4`	affected	—
`1.5`	affected	—
`1.6`	affected	—
`1.7`	affected	—
`1.8`	affected	—
`1.9`	affected	—
`1.10`	affected	—
`1.11`	affected	—
`1.12`	affected	—
`1.13`	affected	—
`1.14`	affected	—
`1.15`	affected	—
`1.16`	affected	—
`1.17`	affected	—
`1.18`	affected	—
`1.19`	affected	—
`1.20`	affected	—
`1.21`	affected	—
`1.22`	affected	—
`1.23`	affected	—
`1.24`	affected	—
`1.25`	affected	—
`1.26`	affected	—
`1.27`	affected	—
`1.28`	affected	—
`1.29`	affected	—
`1.30`	affected	—
`1.31`	affected	—
`1.32`	affected	—
`1.33`	affected	—
`1.34`	affected	—
`1.35`	affected	—
`1.36`	affected	—
`1.37`	affected	—
`1.38`	affected	—
`1.39.0`	affected	—

No data.

Vendor Product Confidence Versions

Sony

Neural Network Libraries

90%

Version	Status	Scheme	Platform
`1.0`	affected	generic	—
`1.1`	affected	generic	—
`1.2`	affected	generic	—
`1.3`	affected	generic	—
`1.4`	affected	generic	—
`1.5`	affected	generic	—
`1.6`	affected	generic	—
`1.7`	affected	generic	—
`1.8`	affected	generic	—
`1.9`	affected	generic	—
`1.10`	affected	generic	—
`1.11`	affected	generic	—
`1.12`	affected	generic	—
`1.13`	affected	generic	—
`1.14`	affected	generic	—
`1.15`	affected	generic	—
`1.16`	affected	generic	—
`1.17`	affected	generic	—
`1.18`	affected	generic	—
`1.19`	affected	generic	—
`1.20`	affected	generic	—
`1.21`	affected	generic	—
`1.22`	affected	generic	—
`1.23`	affected	generic	—
`1.24`	affected	generic	—
`1.25`	affected	generic	—
`1.26`	affected	generic	—
`1.27`	affected	generic	—
`1.28`	affected	generic	—
`1.29`	affected	generic	—
`1.30`	affected	generic	—
`1.31`	affected	generic	—
`1.32`	affected	generic	—
`1.33`	affected	generic	—
`1.34`	affected	generic	—
`1.35`	affected	generic	—
`1.36`	affected	generic	—
`1.37`	affected	generic	—
`1.38`	affected	generic	—
`1.39.0`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00234.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md
https://vuldb.com/cve/CVE-2026-116103
https://vuldb.com/submit/1003039
https://vuldb.com/vuln/426171
https://vuldb.com/vuln/426171/cti

History

Mon, 26 Oct 2026 02:15:00 +0100

Type	Values Removed	Values Added
Description		A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Title		Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection
First Time appeared		Sony Sony neural Network Libraries
Weaknesses		CWE-74 CWE-94
CPEs		cpe:2.3:a:sony:neural_network_libraries::::::::
Vendors & Products		Sony Sony neural Network Libraries
References		https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md https://vuldb.com/cve/CVE-2026-116103 https://vuldb.com/submit/1003039 https://vuldb.com/vuln/426171 https://vuldb.com/vuln/426171/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Sony Neural Network Libraries

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-26T00:45:29.142Z

Updated: 2026-10-26T00:45:29.142Z

Reserved: 2026-10-25T07:37:29.567Z

Link: CVE-2026-116103

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-10-26T01:17:15.553

Modified: 2026-10-26T13:41:11.497

Link: CVE-2026-116103

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-26T06:45:05Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object