CVE-2026-116104: Sony Neural Network Libraries code injection in NNP Converter

Summary

CVE-2026-116104 is a flaw in Sony Neural Network Libraries up to 1.39.0, in the func_set_nnabla_version_decorate function of python/src/nnabla/utils/converter/utils.py within the NNP Converter component. Manipulating the function.type argument leads to code injection, and the attack can be started remotely. A public exploit exists, and the vendor did not respond to early disclosure contact; the flaw affects only products no longer supported by the maintainer.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-116103: Sony Neural Network Libraries code injection in encode param command handlerSimilar attack · NVD/CVE Database
• MediumPHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingSimilar attack · The Hacker News
• HighCVE-2026-116176: vLLM server-side request forgery via X-Request-Id decode addressSimilar attack · NVD/CVE Database
• InfoOpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox CommunicationSimilar attack · The Hacker News
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSimilar attack · GitHub Advisory Database