PT-2026-59875

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59916

Impact The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. python import tensorflow as tf tf.raw ops.SobolSampledim=tf.constant1,0, num results=tf.constant1, skip=tf.constant1...

PT-2026-59784

Impact The macros that TensorFlow uses for writing assertions e.g., CHECK LT, CHECK GT, etc. have an incorrect logic when comparing size t and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit...

PT-2026-59971

Impact The implementation of tf.raw ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf ckpt path = tf.constant "/tmp/warm starting util...

PT-2026-59752

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: cc const auto& init op sig it = meta graph def.signature def.findkSavedModelInitOpSignatureKey; if init op sig it != sig def map.end init op name = init op sig it-second.outputs...

PT-2026-59703

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel: library function signature name: "SomeOp" description:...

PT-2026-59813

Impact The implementation of tf.raw ops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf index = tf.constant, shape=0, dtype=tf.int32 tf.raw ops.StagePeekindex=index,...

PT-2026-59873

Impact The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation: python import tensorflow as tf import numpy as np tf.raw ops.SparseCountSparseOutput indices=1,1, values=2, dense shape=2 31, 2 3...

PT-2026-59819

Impact The implementation of tf.raw ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.UnsortedSegmentJoin inputs=tf.constant"this", shape=12,...

PT-2026-59796

Impact The implementation of tf.raw ops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf handle = tf.constant"", shape=0, dtype=tf.string tf.raw...

PT-2026-59762

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: python import tensorflow as tf tf.raw ops.StringNGrams data='123456', data splits=0,1, separator='a'15, ngram widths=, left pad='', right pad='', pad...

PT-2026-59979

Impact The implementation of tf.raw ops.SparseTensorDenseAdd does not fully validate the input arguments: python import tensorflow as tf a indices = tf.constant0, shape=17, 2, dtype=tf.int64 a values = tf.constant, shape=0, dtype=tf.float32 a shape = tf.constant6, 12, shape=2, dtype=tf.int64 b =...

PT-2026-59729

Impact The implementation of tf.raw ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

PT-2026-59798

Impact A malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as reference types are not allowed. Patches We have patch...

PT-2026-59868

Impact In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a...

PT-2026-59780

Impact The implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory: python import tensorflow as tf tf.ragged.constantpylist=,ragged rank=8968073515812833920 Patches We have patched the issue in GitHub...

PT-2026-59785

Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf tf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64 This i...

PT-2026-59828

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argumen...

PT-2026-59711

Impact When Conv2DBackpropInput receives empty out backprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input sizes = 3, 1, 1, 2 filter...

PT-2026-59751

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: python import tensorflow as tf import numpy as np tf.raw ops.FractionalMaxPool value=tf.constantvalue=1, 4, 2, 3, dtype=tf.int64, pooling ratio=1.0, 1.44, 1.73, 1.0, pseudo random=False,...