PT-2026-59857

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0: python import tensorflow as tf @tf.function def test: y=tf.raw ops.AvgPoolGrad orig input shape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0,...

PT-2026-59813

Impact The implementation of tf.raw ops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf index = tf.constant, shape=0, dtype=tf.int32 tf.raw ops.StagePeekindex=index,...

PT-2026-59804

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar: python import tensorflow as tf import numpy as np tf.raw ops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

PT-2026-59790

Impact When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference: cc string allowed gpus = flr-config proto-gpu options.visible device list; In the default scenario, all devices are allowed, so flr-config proto is nullptr. Patches We have...

PT-2026-59781

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail: python import tensorflow as tf tf.raw ops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binary output=False There are several conditio...

PT-2026-59812

Impact The implementation of tf.raw ops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

PT-2026-59708

Impact The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...

PT-2026-59707

Impact The implementation of tf.raw ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service: python import tensorflow as tf hypothesis indices = tf.constant-1250999896764, shape=3, 3, dtype=tf.int64 hypothesis values =...

PT-2026-59996

Impact The implementation of tf.histogram fixed width is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogram fixed widthvalues=np.nan, value range=1,2 The implementation assumes that all floating point operations are...

PT-2026-59727

Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. Patches We have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662. The fix will be included in...

PT-2026-59728

Impact TensorFlow is vulnerable to a heap OOB write in Grappler: cc Status SetUnknownShapeconst NodeDef node, int output port shape inference::ShapeHandle shape = GetUnknownOutputShapenode, output port; InferenceContext ctx = GetContextnode; if ctx == nullptr return errors::InvalidArgument"Missin...

PT-2026-59701

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses: python import tensorflow as tf @tf.function def test: y = tf.raw ops.Dequantize input=tf.constant1,1,dtype=tf.qint32, min range=1.0, max range=10.0, mode='MIN COMBINED', narrow...

PT-2026-59718

Impact An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. Patches We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038...

PT-2026-59731

Impact Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid: python import tensorflow as tf tf.raw ops.QueueIsClosedV2handle= python import tensorflow as tf tf.summary.flushwriter= In graph mode, it would have been impossible to perform these...

PT-2026-59729

Impact The implementation of tf.raw ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

PT-2026-59723

Impact There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types added after migration to TF 2.x: python import numpy as np import tensorflow as tf tf.compat.v1.placeholder with...

PT-2026-59709

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: python import tensorflow as tf tf.raw ops.UnravelIndexindices=-0x100000,dims=0x100000,0x100000 Patches We have patched the issue in GitHub commit...

PT-2026-59719

Impact A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. cc int64 t TensorByteSizeconst TensorProto& t // num elements returns -1 if shape is not fully defined. int64 t num elems = TensorShapet.tensor shape.num elements;...

PT-2026-59715

Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

PT-2026-59762

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: python import tensorflow as tf tf.raw ops.StringNGrams data='123456', data splits=0,1, separator='a'15, ngram widths=, left pad='', right pad='', pad...