PT-2026-59731

Impact Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid: python import tensorflow as tf tf.raw ops.QueueIsClosedV2handle= python import tensorflow as tf tf.summary.flushwriter= In graph mode, it would have been impossible to perform these...

PT-2026-59718

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038...

PT-2026-59996

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59785

Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf tf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64 This i...

PT-2026-59810

Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. cc size t maxRank = 0; for auto shape : llvm::enumerateshapes auto found shape = analysis.dimensionsForShapeTensorshape.value; if...

PT-2026-59841

Impact The implementation of tf.raw ops.QuantizedConv2D does not fully validate the input arguments: python import tensorflow as tf input = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 filter = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 bad args min input = tf.constant, shape=0,...

PT-2026-59817

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...

PT-2026-59933

Impact The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. Patches We have patched the issue in GitHub commit...

PT-2026-59755

Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: cc Status s = params .create kerneln-properties, &item-kernel; if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a...

PT-2026-59713

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.raw ops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, min input = , max input = 1, ksize = 1, 1, 1, 1,...

PT-2026-59763

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations: cc int embedding size = 1; int lookup size = 1; for int i = 0; i data.i32i; lookup size = dim; output shape-datak = dim; for int i = 1; i datak = dim; Both embedding size and lookup si...

PT-2026-59756

Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. Patches We have patched the issue in GitHub...

PT-2026-59761

Impact The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. python import tensorflow as tf tf.raw ops.SobolSampledim=tf.constant1,0, num results=tf.constant1, skip=tf.constant1...

PT-2026-59781

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail: python import tensorflow as tf tf.raw ops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binary output=False There are several conditio...

PT-2026-59813

Impact The implementation of tf.raw ops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf index = tf.constant, shape=0, dtype=tf.int32 tf.raw ops.StagePeekindex=index,...

PT-2026-59856

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& op def, const std::vector& input tensors, const std::vector& input tensors as shapes const auto ret = full type::SpecializeTypeattrs , op def;...

PT-2026-59804

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: python import tensorflow as tf import numpy as np tf.raw ops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

PT-2026-59875

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59923

Impact The TFG dialect of TensorFlow MLIR makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect. If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can...

PT-2026-59913

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...