Sony NNabla EUVD-2026-109592

Exploitation requires that a victim run the NNP Converter component on an attacker-crafted NNP model file in which the 'function.type' argument contains Python code; func_set_nnabla_version_decorate in python/src/nnabla/utils/converter/utils.py passes that value to eval(). Limiting factors (per CVSS UI:P and the description): the attack is not automatic - a user or automated pipeline must actively load/convert the malicious model, so there is no path without someone processing attacker-supplied input. Exposure is further bounded to end-of-life versions up to and including 1.39.0, and because the product is no longer supported and the vendor did not respond, no official fixed version is available; the only mitigations are operational (avoid converting untrusted model files, migrate off the unsupported library).

This is a low-urgency issue despite being a code-injection flaw (CWE-74). The vendor-supplied CVSS 4.0 vector is AV:N/AC:L/PR:N/UI:P with only Low impact (VC:L/VI:L/VA:L), yielding a base score of 2.1, and the vuln.today decision label is 'monitor' - the lowest actionable tier. No CISA KEV entry is present (not confirmed actively exploited) and no EPSS probability was supplied, so widespread or automated exploitation is not evidenced. Working against the low score: the root cause is an eval() on the attacker-controlled function.type field, which in principle yields arbitrary Python execution in the converter's process - this suggests the real technical impact is higher than the Low C/I/A that vuldb assigned, so the 2.1 score likely understates consequence. Working in favor of low priority: exploitation is not unauthenticated-and-fire-and-forget - the CVSS vector carries UI:P (user interaction), meaning a victim must actually run the NNP Converter on an attacker-supplied model file. The affected product is also explicitly end-of-life ('only affects products no longer supported by the maintainer'), limiting the exposed population. Net: a genuine code-injection bug with public PoC, but gated by user interaction, confined to an unsupported niche ML tool, and not tied to any confirmed active exploitation - closer to a high-severity-mechanism / low-real-world-risk profile than an emergency.

An attacker publishes or sends a malicious NNP model file whose 'function.type' field embeds Python code. A developer or pipeline that uses Sony Neural Network Libraries' NNP Converter runs the conversion on that file, and func_set_nnabla_version_decorate in utils.py passes the attacker-controlled value to eval(), executing the injected code in the converter's context. A public PoC reference exists (GitHub) and the disclosure states the exploit has been released, so the technical barrier to reproduction is low, though a victim must still choose to process the crafted model.