PT-2026-59913

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

PT-2026-59857

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0: python import tensorflow as tf @tf.function def test: y=tf.raw ops.AvgPoolGrad orig input shape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0,...

PT-2026-59842

Impact A GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it: cc if op reg data-type ctor != nullptr VLOG3 op def; const FullTypeDef ctor typedef =...

PT-2026-59831

Impact The implementation of tf.raw ops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf indices = tf.constant53, shape=3, dtype=tf.int64 values =...

PT-2026-59707

Impact The implementation of tf.raw ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesis indices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesis values =...

PT-2026-59704

Impact A malicious user can cause a use after free behavior when decoding PNG images: cc if / ... error conditions ... / png::CommonFreeDecode&decode; OP REQUIREScontext, false, errors::InvalidArgument"PNG size too large for int: ", decode.width, " by ", decode.height; After...

PT-2026-59727

Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. Patches We have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662. The fix will be included in...

PT-2026-59706

Impact The implementation of tf.raw ops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import numpy as np import tensorflow as tf tf.raw ops.TensorSummaryV2 tag=np.array'test',...

PT-2026-59881

Impact The implementation of tf.raw ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesis indices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesis values =...

PT-2026-59895

Impact Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid: python import tensorflow as tf tf.raw ops.QueueIsClosedV2handle= python import tensorflow as tf tf.summary.flushwriter= In graph mode, it would have been impossible to perform these...

PT-2026-59948

Impact The implementation of tf.raw ops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

PT-2026-59701

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses: python import tensorflow as tf @tf.function def test: y = tf.raw ops.Dequantize input=tf.constant1,1,dtype=tf.qint32, min range=1.0, max range=10.0, mode='MIN COMBINED', narrow...

PT-2026-59821

Impact When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow...

PT-2026-59726

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

PT-2026-59728

Impact TensorFlow is vulnerable to a heap OOB write in Grappler: cc Status SetUnknownShapeconst NodeDef node, int output port shape inference::ShapeHandle shape = GetUnknownOutputShapenode, output port; InferenceContext ctx = GetContextnode; if ctx == nullptr return errors::InvalidArgument"Missin...

PT-2026-59777

Impact The implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements: cc int64 t OpLevelCostEstimator::CalculateTensorSize const OpInfo::TensorProperties...

PT-2026-59711

Impact When Conv2DBackpropInput receives empty out backprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input sizes = 3, 1, 1, 2 filter...

PT-2026-59884

Impact When Conv2DBackpropInput receives empty out backprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input sizes = 3, 1, 1, 2 filter...

PT-2026-59762

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: python import tensorflow as tf tf.raw ops.StringNGrams data='123456', data splits=0,1, separator='a'15, ngram widths=, left pad='', right pad='', pad...

PT-2026-59775

Impact The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory: python import tensorflow as tf y = tf.raw ops.ThreadPoolHandlenum threads=0x60000000,display name='tf' This is because the num threads argument is only checked to not be...