PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116104 Sony CVE debrief

A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Vendor
Sony
Product
Neural Network Libraries
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-26
Original CVE updated
2026-11-02
Advisory published
2026-10-26
Advisory updated
2026-11-02

Who should care

Defenders responsible for maintaining and securing systems that utilize Sony Neural Network Libraries up to version 1.39.0 should be aware of this vulnerability and take necessary actions to verify and mitigate it.

Why it matters

This vulnerability allows for code injection in Sony Neural Network Libraries up to version 1.39.0, which can be exploited remotely. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assess potential compensating controls.

  • Verify the presence of vulnerable Sony Neural Network Libraries in your inventory.
  • Assess the potential for code injection attacks targeting the NNP Converter component.
  • Implement compensating controls to mitigate the vulnerability, if possible.

Technical summary

The vulnerability is located in the func_set_nnabla_version_decorate function of the python/src/nnabla/utils/converter/utils.py file in the NNP Converter component of Sony Neural Network Libraries up to version 1.39.0. An attacker can inject code by manipulating the function.type argument. This vulnerability allows for code injection in Sony Neural Network Libraries up to version 1.39.0, which can be exploited remotely. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assess potential compensating controls.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory, especially if they are using Sony Neural Network Libraries up to version 1.39.0, and assess if any compensating controls can be applied.

Recommended defensive actions

  • Verify the presence of Sony Neural Network Libraries up to version 1.39.0 in your inventory.
  • Assess if any compensating controls can be applied to mitigate the vulnerability.
  • Monitor for potential exploits or attacks targeting this vulnerability.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected components. However, the vendor did not respond to the disclosure, and there is limited information about potential exploits or attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116104 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116104

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116104 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116104

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.