The vulnerability resides in the load_param_in_txt function of Sony’s Neural Network Libraries, specifically within the Encode Param Command Handler. When an attacker supplies a crafted input file to the encode_decode_param.py utility, the function evaluates untrusted content, enabling code injection that satisfies CWE‑94. This capability can be leveraged to execute arbitrary shell commands, which is a classic command‑injection scenario identified as CWE‑74. The result is that a remote actor could inject and run arbitrary commands on the host system that runs the vulnerable library.

Sony Neural Network Libraries versions up to and including 1.39.0 are affected. The issue is confined to releases that are no longer supported by the maintainer, meaning that any installation referencing those legacy versions is at risk. No other Sony product or component was explicitly identified as vulnerable in this advisory.

The CVSS score of 5.3 places this vulnerability in the medium severity category. EPSS information is not available, yet publicly available exploit code demonstrates that the attack can be initiated from outside the local host, indicating a remote attack vector. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw permits arbitrary command execution, the potential impact on confidentiality, integrity, and availability is significant for systems that maintain the affected library versions.