PT-2026-59754

Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. Patches We have patched the issue in GitHub commi...

PT-2026-59771

Impact Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a SavedModel file fixing the first one would trigger the same dereference in the second place: First, during...

PT-2026-59739

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batch dim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ReverseSequence input = 'aaa','bbb', seq lengths = 1,1,1, seq dim = -10, batch di...

PT-2026-59751

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: python import tensorflow as tf import numpy as np tf.raw ops.FractionalMaxPool value=tf.constantvalue=1, 4, 2, 3, dtype=tf.int64, pooling ratio=1.0, 1.44, 1.73, 1.0, pseudo random=False,...

PT-2026-59715

Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

PT-2026-59719

Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. cc int64 t TensorByteSizeconst TensorProto& t // num elements returns -1 if shape is not fully defined. int64 t num elems = TensorShapet.tensor shape.num elements;...

PT-2026-59979

Impact The implementation of tf.raw ops.SparseTensorDenseAdd does not fully validate the input arguments: python import tensorflow as tf a indices = tf.constant0, shape=17, 2, dtype=tf.int64 a values = tf.constant, shape=0, dtype=tf.float32 a shape = tf.constant6, 12, shape=2, dtype=tf.int64 b =...

PT-2026-59971

Impact The implementation of tf.raw ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf ckpt path = tf.constant "/tmp/warm starting util...

PT-2026-59956

Impact The implementation of tf.raw ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.strings.unsorted segment join inputs='123', segment ids=0, num...

PT-2026-59958

Impact The implementation of tf.raw ops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow: python import tensorflow as tf input = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32 block shape = tf.constant-1879048192, shape=2, dtype=tf.int...

PT-2026-59916

Impact The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. python import tensorflow as tf tf.raw ops.SobolSampledim=tf.constant1,0, num results=tf.constant1, skip=tf.constant1...

PT-2026-59846

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of allocations, but does not check that the right hand...

PT-2026-59703

Impact The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel: library function signature name: "SomeOp" description:...

PT-2026-59731

Impact Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid: python import tensorflow as tf tf.raw ops.QueueIsClosedV2handle= python import tensorflow as tf tf.summary.flushwriter= In graph mode, it would have been impossible to perform these...

PT-2026-59718

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038...

PT-2026-59996

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59810

Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. cc size t maxRank = 0; for auto shape : llvm::enumerateshapes auto found shape = analysis.dimensionsForShapeTensorshape.value; if...

PT-2026-59841

Impact The implementation of tf.raw ops.QuantizedConv2D does not fully validate the input arguments: python import tensorflow as tf input = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 filter = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 bad args min input = tf.constant, shape=0,...

PT-2026-59817

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...

PT-2026-59755

Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: cc Status s = params .create kerneln-properties, &item-kernel; if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a...