Is CVE-2026-116103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116103 being exploited in the wild.

How severe is CVE-2026-116103?

Medium severity, with a CVSS score of 6.3, published 26 October 2026.

Which products and versions are affected?

Sony Neural Network Libraries up to 1.39.0.

Is there a fix for CVE-2026-116103?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-116103 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116103?

Check whether you run Sony Neural Network Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116103: Sony Neural Network Libraries code injection in encode_param

CVE-2026-116103 · Severity: medium · CVSS 6.3 · Published 2026-10-26

Sony Neural Network Libraries is a machine learning framework used by developers to build neural network applications. A code injection vulnerability in the encode_param command allows an attacker to execute arbitrary code remotely, potentially compromising systems that use this library. The vulnerability affects older versions of the library that are no longer maintained by Sony.

Vendors: Sony.

Quick answers

Is CVE-2026-116103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116103 being exploited in the wild.
How severe is CVE-2026-116103?: Medium severity, with a CVSS score of 6.3, published 26 October 2026.
Which products and versions are affected?: Sony Neural Network Libraries up to 1.39.0.
Is there a fix for CVE-2026-116103?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116103 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116103?: Check whether you run Sony Neural Network Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection flaw exists in the load_param_in_txt function within python/src/nnabla/utils/cli/encode_decode_param.py of the Encode Param Command Handler component. The vulnerability allows remote code execution via manipulation of input to the nnabla_cli encode_param command. The exploit is publicly available and no patch is available since the affected versions are no longer supported.

Affected products

Sony Neural Network Libraries up to 1.39.0

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.