TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`

ImpactIf FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfnumbits = 8narrowrange = Falseinputs = tf.constant0, shape=4, dtype=tf.float32min =...

TensorFlow vulnerable to `CHECK` fail in `QuantizeAndDequantizeV3`

ImpactIf QuantizeAndDequantizeV3 is given a nonscalar numbits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfsignedinput = Truerangegiven = Falsenarrowrange = Falseaxis = -1input = tf.constant-3.5, shape=1,...

PYSEC-2026-3304 TensorFlow vulnerable to `CHECK` fail in `QuantizeAndDequantizeV3`

Impact If QuantizeAndDequantizeV3 is given a nonscalar numbits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf signedinput = True rangegiven = False narrowrange = False axis = -1 input = tf.constant-3.5, shape=1,...

PYSEC-2026-3348 TensorFlow vulnerable to `CHECK` fail in `RaggedTensorToVariant`

Impact If RaggedTensorToVariant is given a rtnestedsplits list that contains tensors of ranks other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf batchedinput = True rtnestedsplits = tf.constant0,32,64, shape=3,...

PYSEC-2026-3149 TensorFlow vulnerable to `CHECK` fail in `QuantizeAndDequantizeV3`

Impact If QuantizeAndDequantizeV3 is given a nonscalar numbits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf signedinput = True rangegiven = False narrowrange = False axis = -1 input = tf.constant-3.5, shape=1,...

TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

ImpactWhen converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.pythonimport tensorflow as tfclass QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

PYSEC-2026-3215 TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

Impact The AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program. python import tensorflow as tf import numpy as np value = np.ones1, 1, 1, 1 ksize = 1, 1e20, 1, 1 strides = 1, 1, 1, 1 padding = 'SAM...

PYSEC-2026-3212 TensorFlow vulnerable to `CHECK` fail in `RaggedTensorToVariant`

Impact If RaggedTensorToVariant is given a rtnestedsplits list that contains tensors of ranks other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf batchedinput = True rtnestedsplits = tf.constant0,32,64, shape=3,...

PYSEC-2026-3306 TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`

Impact If FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf numbits = 8 narrowrange = False inputs = tf.constant0, shape=4, dtype=tf.float32 min ...

PYSEC-2026-3351 TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

Impact The AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program. python import tensorflow as tf import numpy as np value = np.ones1, 1, 1, 1 ksize = 1, 1e20, 1, 1 strides = 1, 1, 1, 1 padding = 'SAM...

TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

ImpactWhen converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.pythonimport tensorflow as tfclass QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

PYSEC-2026-3128 TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

Impact When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. python import tensorflow as tf class QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

PT-2026-59204

Summary TensorFlow / Keras continues to honor HDF5 “external storage” and ExternalLink features when loading weights. A malicious .weights.h5 or a .keras archive embedding such weights can direct load weights to read from an arbitrary readable filesystem path. The bytes pulled from that path...

PT-2026-59826

Impact When DrawBoundingBoxes receives an input boxes that is not of dtype float, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf import numpy as np arg 0=tf.constantvalue=np.random.randomsize=1, 3, 2, 3, shape=1, 3, 2, 3, dtype=tf.half arg...

PT-2026-59782

Impact If FractionMaxPoolGrad is given outsize inputs row pooling sequence and col pooling sequence, TensorFlow will crash. python import tensorflow as tf tf.raw ops.FractionMaxPoolGrad orig input = 1, 1, 1, 1, 1, orig output = 1, 1, 1, out backprop = 3, 3, 6, row pooling sequence = -0x4000000, 1...

PT-2026-59844

Impact The implementation of Conv2DBackpropInput requires input sizes to be 4-dimensional. Otherwise, it gives a CHECK failure which can be used to trigger a denial of service attack: python import tensorflow as tf strides = 1, 1, 1, 1 padding = "SAME" use cudnn on gpu = True explicit paddings =...

PT-2026-59980

Impact If the stride and window size are not positive for tf.raw ops.AvgPoolGrad, it can give an FPE. python import tensorflow as tf import numpy as np @tf.functionjit compile=True def test: y = tf.raw ops.AvgPoolGradorig input shape=1,0,0,0, grad=0.39117979, ksize=1,0,0,0, strides=1,0,0,0,...

PT-2026-59760

Impact The function tf.raw ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. python import tensorflow as tf v = tf.Variable1 @tf.functionjit compile=True def test: func = tf.raw ops.LookupTableImportV2 para='table handle': v.handle,'keys': 62.98910140991211,...

PT-2026-59908

Impact When running with XLA, tf.raw ops.Bincount segfaults when given a parameter weights that is neither the same shape as parameter arr nor a length-0 tensor. python import tensorflow as tf func = tf.raw ops.Bincount para='arr': 6, 'size': 804, 'weights': 52, 351 @tf.functionjit compile=True d...

PT-2026-59896

Impact FPE in TensorListSplit with XLA python import tensorflow as tf func = tf.raw ops.TensorListSplit para = 'tensor': 1, 'element shape': -1, 'lengths': 0 @tf.functionjit compile=True def fuzz jit: y = funcpara return y printfuzz jit Patches We have patched the issue in GitHub commit...