CVE-2026-2492 | High | 7.8 | 2026-02-20 | TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil… |
CVE-2023-33976 | High | 7.5 | 2024-07-30 | TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will b… |
CVE-2024-3660 | Critical | 9.8 | 2024-04-16 | A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the ap… |
CVE-2023-25661 | Medium | 6.5 | 2023-03-27 | TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and ca… |
CVE-2023-27579 | High | 7.5 | 2023-03-25 | TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives… |
CVE-2023-25801 | High | 8.0 | 2023-03-25 | TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2… |
CVE-2023-25676 | High | 7.5 | 2023-03-25 | TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a… |
CVE-2023-25675 | High | 7.5 | 2023-03-25 | TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.Bincount` segfaults when given a… |
CVE-2023-25674 | High | 7.5 | 2023-03-25 | TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix… |
CVE-2023-25673 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A… |
CVE-2023-25672 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and g… |
CVE-2023-25671 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in TensorFlow… |
CVE-2023-25670 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize… |
CVE-2023-25669 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for `tf.raw_ops… |
CVE-2023-25668 | Critical | 9.8 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the con… |
CVE-2023-25667 | Medium | 6.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height * wi… |
CVE-2023-25666 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix… |
CVE-2023-25665 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as… |
CVE-2023-25664 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is incl… |
CVE-2023-25663 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup functi… |
CVE-2023-25662 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is in… |
CVE-2023-25660 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero… |
CVE-2023-25659 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the parameter `indices` for `DynamicStitch` does not match… |
CVE-2023-25658 | High | 7.5 | 2023-03-25 | TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, an out of bounds read is in GRUBlockCellGrad. A fix is include… |
CVE-2022-41910 | Medium | 4.8 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-41902 | High | 7.1 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-41911 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying stor… |
CVE-2022-41909 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `… |
CVE-2022-41908 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`… |
CVE-2022-41907 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have pa… |
CVE-2022-41901 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail… |
CVE-2022-41900 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers… |
CVE-2022-41899 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaO… |
CVE-2022-41898 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issu… |
CVE-2022-41897 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`… |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41895 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We hav… |
CVE-2022-41894 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the dat… |
CVE-2022-41893 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fa… |
CVE-2022-41891 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which c… |
CVE-2022-41890 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to… |
CVE-2022-41889 | Medium | 5.5 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tens… |
CVE-2022-41888 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must… |
CVE-2022-41887 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` i… |
CVE-2022-41886 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have p… |
CVE-2022-41885 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patc… |
CVE-2022-41884 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a larg… |
CVE-2022-41880 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_ma… |
CVE-2022-41883 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will cr… |
CVE-2022-36027 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaul… |
CVE-2022-36017 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` t… |
CVE-2022-36016 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly t… |
CVE-2022-36015 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched the… |
CVE-2022-36014 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched th… |
CVE-2022-36013 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it… |
CVE-2022-36012 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashe… |
CVE-2022-36011 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives… |
CVE-2022-36005 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is… |
CVE-2022-36004 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigg… |
CVE-2022-36003 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigg… |
CVE-2022-36002 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial o… |
CVE-2022-36001 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a `CHECK`… |
CVE-2022-36000 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives… |
CVE-2022-35999 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empty `out_backprop` inputs (e.g. `[3, 1, 0, 1]`), the current… |
CVE-2022-35998 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CH… |
CVE-2022-35997 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail th… |
CVE-2022-35996 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is al… |
CVE-2022-35995 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a `CHECK… |
CVE-2022-35994 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used… |
CVE-2022-35993 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that… |
CVE-2022-35992 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHE… |
CVE-2022-35991 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element_shape` of a rank greater tha… |
CVE-2022-36026 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK`… |
CVE-2022-36019 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it… |
CVE-2022-36018 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other… |
CVE-2022-35990 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_per_channel_gradient` receives input `min` or `m… |
CVE-2022-35989 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input te… |
CVE-2022-35988 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that… |
CVE-2022-35987 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tenso… |
CVE-2022-35986 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be u… |
CVE-2022-35985 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail… |
CVE-2022-35984 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64`… |
CVE-2022-35983 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fa… |
CVE-2022-35982 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a v… |
CVE-2022-35981 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `FractionalMaxPoolGrad` validates its inputs with `CHECK` failures instead of with returning errors… |
CVE-2022-35979 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_featur… |
CVE-2022-35974 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it result… |
CVE-2022-35973 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a… |
CVE-2022-35972 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzer… |
CVE-2022-35971 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a `CH… |
CVE-2022-35970 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a s… |
CVE-2022-35969 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise… |
CVE-2022-35968 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This resu… |
CVE-2022-35967 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a se… |
CVE-2022-35966 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in… |
CVE-2022-35965 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `LowerBound` or `UpperBound` is given an empty`sorted_inputs` input, it results in a `nullptr` d… |
CVE-2022-35964 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a seg… |
CVE-2022-35963 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `FractionalAvgPoolGrad` does not fully validate the input `orig_input_tensor_… |
CVE-2022-35960 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. In `core/kernels/list_kernels.cc's TensorListReserve`, `num_elements` is assumed to be a tensor of… |
CVE-2022-35959 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `AvgPool3DGradOp` does not fully validate the input `orig_input_shape`. This… |