PT-2026-59781

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail: python import tensorflow as tf tf.raw ops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binary output=False There are several conditio...

PT-2026-59726

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

PT-2026-59831

Impact The implementation of tf.raw ops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf indices = tf.constant53, shape=3, dtype=tf.int64 values =...

PT-2026-59714

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added...

PT-2026-59704

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if / ... error conditions ... / png::CommonFreeDecode&decode; OP REQUIREScontext, false, errors::InvalidArgument"PNG size too large for int: ", decode.width, " by ", decode.height; After...

PT-2026-59892

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

PT-2026-59973

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

PT-2026-59713

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.raw ops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, min input = , max input = 1, ksize = 1, 1, 1, 1,...

PT-2026-59808

Impact A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that cas...

PT-2026-59838

Impact The implementation of tf.raw ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf ckpt path = tf.constant "/tmp/warm starting util...

PT-2026-59774

Impact The TFG dialect of TensorFlow MLIR makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect. If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can...

PT-2026-59930

Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf tf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64 This i...

PT-2026-59754

Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. Patches We have patched the issue in GitHub commi...

PT-2026-59701

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses: python import tensorflow as tf @tf.function def test: y = tf.raw ops.Dequantize input=tf.constant1,1,dtype=tf.qint32, min range=1.0, max range=10.0, mode='MIN COMBINED', narrow...

PT-2026-59721

Impact An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated. Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0. The fix will be included in TensorFlow 2.8.0. W...

PT-2026-59882

Impact The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...

PT-2026-59881

Impact The implementation of tf.raw ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesis indices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesis values =...

PT-2026-59739

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batch dim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ReverseSequence input = 'aaa','bbb', seq lengths = 1,1,1, seq dim = -10, batch di...

PT-2026-59884

Impact When Conv2DBackpropInput receives empty out backprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input sizes = 3, 1, 1, 2 filter...

PT-2026-59805

Impact An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation: cc inline void BiasAndClampfloat clamp min, float clamp max, int bias size, const float bias data, int array size, float array data // ... TFLITE DCHECK EQarray size % bias size, 0; /...