PYSEC-2026-943 Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow

Impact The implementation of tf.rawops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesisindices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesisvalues =...

Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow

ImpactThe implementation of tf.rawops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service:pythonimport tensorflow as tfhypothesisindices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesisvalues = tf.constant0...

Heap buffer overflow due to incorrect hash function in TensorFlow

ImpactThe TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because the...

PYSEC-2026-952 Incomplete validation in signal ops leads to crashes in TensorFlow

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

Code injection in `saved_model_cli` in TensorFlow

ImpactTensorFlow's savedmodelcli tool is vulnerable to a code injection:savedmodelcli run --inputexprs 'x=print"malicious code to run"' --dir ./--tagset serve --signaturedef servingdefaultThis can be used to open a reverse shell savedmodelcli run --inputexprs 'hello=exec"""\nimport...

Incomplete validation in signal ops leads to crashes in TensorFlow

ImpactThe tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274.The fix will be...

Core dump when loading TFLite models with quantization in TensorFlow

ImpactCertain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling.Thus, since code was calling...

PYSEC-2026-1048 Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

Impact The implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogramfixedwidthvalues=np.nan, valuerange=1,2 The implementation assumes that all floating point operations are defined...

Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

ImpactThe implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements:pythonimport tensorflow as tfimport numpy as nptf.histogramfixedwidthvalues=np.nan, valuerange=1,2The implementation assumes that all floating point operations are defined and th...

Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

ImpactThe macros that TensorFlow uses for writing assertions e.g., CHECKLT, CHECKGT, etc. have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of the macros would trigger incorrectly. PatchesWe have patched the issue in GitHub commit...

PYSEC-2026-972 Core dump when loading TFLite models with quantization in TensorFlow

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

bert-multitask-learning (>=0.1.0, <=0.2.9), miscnn (>=0.6.0, <=0.28.0) potentially affected by CVE-2022-29208 via tensorflow-gpu (1.13.1)

tensorflow-gpu PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - bert-multitask-learning =0.1.0, =0.6.0, =0.28.0 Source cves: CVE-2022-29208 Source advisory: OSV:PYSEC-2026-943...

nuclear-python (>=0.14.4.1, <=0.14.6.2) potentially affected by CVE-2022-29208 via tensorflow-gpu (1.13.2)

tensorflow-gpu PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - nuclear-python =0.14.4.1, =0.14.6.2 Source cves: CVE-2022-29208 Source advisory: OSV:PYSEC-2026-943...

tfhub-styletransfer-wrapper (>=1.0.5, <=1.1.1), tpu-tf2 (1.0.0) potentially affected by CVE-2022-29208 via tensorflow-gpu (2.7.0)

tensorflow-gpu PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - tfhub-styletransfer-wrapper =1.0.5, =1.1.1 - tpu-tf2 1.0.0 Source cves: CVE-2022-29208 Source advisory: OSV:PYSEC-2026-943...

delft (0.2.2) potentially affected by CVE-2022-29208 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2022-29208 Source advisory: OSV:PYSEC-2026-943...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2022-29208 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2022-29208 Source...

classitransformers (0.0.1), pyclue (>=0.1.0, <=0.1.2) +4 more potentially affected by CVE-2022-29208 via tensorflow-gpu (1.15.2)

tensorflow-gpu PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - classitransformers 0.0.1 - pyclue =0.1.0, =0.1.1, =0.1.2, =0.1.2, =0.1.3 Source cves: CVE-2022-29208 Source advisory:...

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

ImpactThe implementation of tf.rawops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

Missing validation causes denial of service via `LoadAndRemapMatrix`

ImpactThe implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfckptpath = tf.constant "/tmp/warmstartingutiltest5kl2a3pc/tmpph76tep2/model-0"...

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1The...