CVE-2026-116103 Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116103?
CVE-2026-116103 is a medium-severity vulnerability in Sony Neural Network Libraries, published on 26 Oct 2026.
Official description
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Which versions are affected by CVE-2026-116103?
How do I fix CVE-2026-116103?
No fix has been published for CVE-2026-116103 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116103 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116103 exists.
Sources
Also known as GHSA-c33q-pqr3-xjv6.