Missing validation causes denial of service via `UnsortedSegmentJoin`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.UnsortedSegmentJoin inputs=tf.constant"this", shape=12,...

PYSEC-2026-3195 Missing validation crashes `QuantizeAndDequantizeV4Grad`

Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.rawops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

Missing validation causes denial of service via `StagePeek`

ImpactThe implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfindex = tf.constant, shape=0, dtype=tf.int32tf.rawops.StagePeekindex=index,...

Missing validation causes denial of service via `DeleteSessionTensor`

ImpactThe implementation of tf.rawops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfhandle = tf.constant"", shape=0,...

PYSEC-2026-3196 Missing validation causes denial of service via `StagePeek`

Impact The implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf index = tf.constant, shape=0, dtype=tf.int32 tf.rawops.StagePeekindex=index,...

Memory leak in Tensorflow

ImpactIf a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize:ccStatus s = params.createkerneln-properties, &item-;kernel;if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a simple...

PYSEC-2026-3138 Memory leak in Tensorflow

Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: cc Status s = params.createkerneln-properties, &item-kernel; if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a simp...

Integer overflow in Tensorflow

ImpactThe implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements:ccint64t OpLevelCostEstimator::CalculateTensorSize const OpInfo::TensorProperties&...

PYSEC-2026-3090 Overflow and uncaught divide by zero in Tensorflow

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: python import tensorflow as tf tf.rawops.UnravelIndexindices=-0x100000,dims=0x100000,0x100000 Patches We have patched the issue in GitHub commit 58b34c6c8250983948b5a781b426f6aa01fd47a...

Division by zero in Tensorflow

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0:pythonimport tensorflow as [email protected] test: y=tf.rawops.AvgPoolGrad originputshape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0, padding='VALID',...

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions.The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added befo...

Assertion failure based denial of service in Tensorflow

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail:pythonimport tensorflow as tftf.rawops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binaryoutput=FalseThere are several conditions tha...

PYSEC-2026-3094 Null pointer dereference in TensorFlow

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.rawops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, mininput = , maxinput = 1, ksize = 1, 1, 1, 1,...

PYSEC-2026-3249 Out of bounds read in Tensorflow

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if nodet.typeid != TFTUNSET int ix = inputidxi; DCHECKix nodet.argssize "input " i " should have an output " ix " but instead only has " nodet.argssize "...

PYSEC-2026-3193 Segfault in `simplifyBroadcast` in Tensorflow

Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. cc sizet maxRank = 0; for auto shape : llvm::enumerateshapes auto foundshape = analysis.dimensionsForShapeTensorshape.value; if...

Crash when type cannot be specialized in Tensorflow

ImpactUnder certain scenarios, TensorFlow can fail to specialize a type during shape inference:ccvoid InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

Integer overflow in TensorFlow

ImpactUnder certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. PatchesWe have patched the issue in GitHub commit...

`CHECK`-fails due to attempting to build a reference tensor

ImpactA malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as reference types are not allowed. PatchesWe have patched...

PYSEC-2026-3127 Out of bounds read and write in Tensorflow

Impact There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write: cc for int i = 0; i argssize; j++ auto arg = t-mutableargsi; // ... Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg...

EUVD-2026-42622

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The...