PYSEC-2026-3113 Abort caused by allocating a vector that is too large in Tensorflow

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto numdims = Valueshapedim; std::vector dims; dims.reservenumdims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7. T...

PT-2026-59752

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: cc const auto& init op sig it = meta graph def.signature def.findkSavedModelInitOpSignatureKey; if init op sig it != sig def map.end init op name = init op sig it-second.outputs...

PT-2026-59930

Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf tf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64 This i...

PT-2026-59784

Impact The macros that TensorFlow uses for writing assertions e.g., CHECK LT, CHECK GT, etc. have an incorrect logic when comparing size t and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit...

PT-2026-59721

Impact An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated. Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0. The fix will be included in TensorFlow 2.8.0. W...

PT-2026-59970

Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf tf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string Patches We have patched the issue ...

PT-2026-59953

Impact The TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32 t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because t...

PT-2026-59926

Impact The implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory: python import tensorflow as tf tf.ragged.constantpylist=,ragged rank=8968073515812833920 Patches We have patched the issue in GitHub...

PT-2026-59889

Impact There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types added after migration to TF 2.x: python import numpy as np import tensorflow as tf tf.compat.v1.placeholder with...

PT-2026-59929

Impact The macros that TensorFlow uses for writing assertions e.g., CHECK LT, CHECK GT, etc. have an incorrect logic when comparing size t and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit...

PT-2026-59892

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

PT-2026-59893

Impact The implementation of tf.raw ops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

PT-2026-59864

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if node t.type id != TFT UNSET int ix = input idxi; DCHECKix node t.args size "input " i " should have an output " ix " but instead only has " node t.args...

PT-2026-59840

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value: python import tensorflow as tf import numpy as np tf.raw ops.SparseTensorSliceDataset indices=, values=, dense shape=1,1 The 3 input arguments...

PT-2026-59848

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 merging 51733. The fix will be included in...

PT-2026-59873

Impact The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation: python import tensorflow as tf import numpy as np tf.raw ops.SparseCountSparseOutput indices=1,1, values=2, dense shape=2 31, 2 3...

PT-2026-59882

Impact The implementation of tf.raw ops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.raw ops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...

PT-2026-59862

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap: python import tensorflow as tf @tf.function def test: y = tf.raw ops.FractionalAvgPoolGrad orig input tensor shape=2,2,2,2, o...

PT-2026-59791

Impact When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode&decode. However, several error case in the function...

PT-2026-59824

Impact The implementation of tf.raw ops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow: python import tensorflow as tf input = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32 block shape = tf.constant-1879048192, shape=2, dtype=tf.int...