PT-2026-59721

Impact An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated. Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0. The fix will be included in TensorFlow 2.8.0. W...

PT-2026-59882

Impact The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...

PT-2026-59881

Impact The implementation of tf.raw ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesis indices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesis values =...

PT-2026-59739

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batch dim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ReverseSequence input = 'aaa','bbb', seq lengths = 1,1,1, seq dim = -10, batch di...

PT-2026-59884

Impact When Conv2DBackpropInput receives empty out backprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input sizes = 3, 1, 1, 2 filter...

PT-2026-59805

Impact An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation: cc inline void BiasAndClampfloat clamp min, float clamp max, int bias size, const float bias data, int array size, float array data // ... TFLITE DCHECK EQarray size % bias size, 0; /...

PT-2026-59756

Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. Patches We have patched the issue in GitHub...

PT-2026-59856

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& op def, const std::vector& input tensors, const std::vector& input tensors as shapes const auto ret = full type::SpecializeTypeattrs , op def;...

PT-2026-59804

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: python import tensorflow as tf import numpy as np tf.raw ops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

PT-2026-59791

Impact When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode&decode. However, several error case in the function...

PT-2026-59715

Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

PT-2026-59709

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: python import tensorflow as tf tf.raw ops.UnravelIndexindices=-0x100000,dims=0x100000,0x100000 Patches We have patched the issue in GitHub commit...

PT-2026-59913

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

PT-2026-59869

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for const auto& dim : output shape.dim output size = dim.size; Here, we can have ...

PT-2026-59864

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if node t.type id != TFT UNSET int ix = input idxi; DCHECKix node t.args size "input " i " should have an output " ix " but instead only has " node t.args...

PT-2026-59843

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

PT-2026-59893

Impact The implementation of tf.raw ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

PT-2026-59996

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59953

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...

PT-2026-59817

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...