PT-2026-59804

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: python import tensorflow as tf import numpy as np tf.raw ops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

PT-2026-59791

Impact When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode&decode. However, several error case in the function...

PT-2026-59715

Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

PT-2026-59709

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: python import tensorflow as tf tf.raw ops.UnravelIndexindices=-0x100000,dims=0x100000,0x100000 Patches We have patched the issue in GitHub commit...

PT-2026-59913

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

PT-2026-59869

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for const auto& dim : output shape.dim output size = dim.size; Here, we can have ...

PT-2026-59864

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if node t.type id != TFT UNSET int ix = input idxi; DCHECKix node t.args size "input " i " should have an output " ix " but instead only has " node t.args...

PT-2026-59843

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

PT-2026-59893

Impact The implementation of tf.raw ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

PT-2026-59996

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59950

Impact The implementation of tf.raw ops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf handle = tf.constant"", shape=0, dtype=tf.string tf.raw...

PT-2026-59973

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

PT-2026-59926

Impact The implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory: python import tensorflow as tf tf.ragged.constantpylist=,ragged rank=8968073515812833920 Patches We have patched the issue in GitHub...

PT-2026-59828

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argumen...

cogdata (>=0.0.6, <=0.0.7), icetk (>=0.0.5, <=0.0.7) +3 more potentially affected by CVE-2026-0994 via protobuf (3.19.0rc2)

protobuf PYPI version 3.19.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cogdata =0.0.6, =0.0.5, =3.0.0a2, =4.7.2 - motion-master-proto 5.2.0 - tensorflow-checkpoint-reader 0.1.2 Source cves: CVE-2026-0994 Source...

hydra-rbp (>=0.1.21.29, <=0.1.21.38), phasespace (>=1.5.0, <=1.6.0) +4 more potentially affected by CVE-2025-12060 via keras (2.7.0rc2)

keras PYPI version 2.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - hydra-rbp =0.1.21.29, =1.5.0, =2.6.0rc1, =0.18.0.dev20210402154254, =0.3.0, =0.3.2 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...

tensorflow (2.6.0rc0) potentially affected by CVE-2025-12060 via keras (2.6.0rc0)

keras PYPI version 2.6.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - tensorflow 2.6.0rc0 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...

genet (>=0.11.0, <=0.17.2), mup-tf (0.0.3) +4 more potentially affected by CVE-2025-12058 via keras (2.11.0rc3)

keras PYPI version 2.11.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - genet =0.11.0, =2.10.0rc1, =2.10.0rc1, =2.10.0rc1, =2.11.0rc0 - tensorflow-text 2.9.0rc1 Source cves: CVE-2025-12058 Source advisory:...

axcorsrmri (0.0.1), behavython (>=0.7.0, <=0.9.8) +8 more potentially affected by CVE-2025-12058 via keras (2.12.0rc1)

keras PYPI version 2.12.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - axcorsrmri 0.0.1 - behavython =0.7.0, =0.3.21, =0.1.5, =0.29.0, =2.11.0rc1, =2.11.0rc1, =2.11.0rc1, =2.11.0rc2 - tensorflow-text 2.10.0rc0 Source...

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically in the converttfweightnametoptweightname function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern /^/^// that can be...