PT-2026-59923

Impact The TFG dialect of TensorFlow MLIR makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect. If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can...

PT-2026-59812

Impact The implementation of tf.raw ops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

PT-2026-59790

Impact When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference: cc string allowed gpus = flr-config proto-gpu options.visible device list; In the default scenario, all devices are allowed, so flr-config proto is nullptr. Patches We have...

PT-2026-59933

Impact The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. Patches We have patched the issue in GitHub commit...

PT-2026-59929

Impact The macros that TensorFlow uses for writing assertions e.g., CHECK LT, CHECK GT, etc. have an incorrect logic when comparing size t and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit...

PT-2026-59708

Impact The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...

PT-2026-59880

Impact The implementation of tf.raw ops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import numpy as np import tensorflow as tf tf.raw ops.TensorSummaryV2 tag=np.array'test',...

PT-2026-59970

Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf tf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string Patches We have patched the issue ...

PT-2026-59972

Impact The implementation of tf.raw ops.QuantizedConv2D does not fully validate the input arguments: python import tensorflow as tf input = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 filter = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 bad args min input = tf.constant, shape=0,...

PT-2026-59719

Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. cc int64 t TensorByteSizeconst TensorProto& t // num elements returns -1 if shape is not fully defined. int64 t num elems = TensorShapet.tensor shape.num elements;...

PT-2026-59846

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of allocations, but does not check that the right hand...

PT-2026-59949

Impact The implementation of tf.raw ops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf index = tf.constant, shape=0, dtype=tf.int32 tf.raw ops.StagePeekindex=index,...

PT-2026-59953

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...

PT-2026-59956

Impact The implementation of tf.raw ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.strings.unsorted segment join inputs='123', segment ids=0, num...

PT-2026-59958

Impact The implementation of tf.raw ops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow: python import tensorflow as tf input = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32 block shape = tf.constant-1879048192, shape=2, dtype=tf.int...

PT-2026-59732

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto num dims = Valueshape dim; std::vector dims; dims.reservenum dims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7...

PT-2026-59765

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. Patches We have patched t...

PT-2026-59744

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write: cc for int i = 0; i args size; j++ auto arg = t-mutable argsi; // ... Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to ar...

PT-2026-59716

Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow: python import tensorflow as tf import numpy as np tf.raw ops.SparseCountSparseOutput indices=-1,-1, values=2, dense shape=1, 1, weights=1, binary output=True, minlength=-1, maxlength=-1, name=None Patches We ha...

PT-2026-59955

Impact The implementation of tf.raw ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.UnsortedSegmentJoin inputs=tf.constant"this", shape=12,...