Type confusion leading to segfault in Tensorflow

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion:pythonimport tensorflow as [email protected] test: y = tf.rawops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return ytestThe axis argument is...

PYSEC-2026-3211 Type confusion leading to segfault in Tensorflow

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.rawops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argument...

Crash when type cannot be specialized in Tensorflow

ImpactUnder certain scenarios, TensorFlow can fail to specialize a type during shape inference:ccvoid InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

PYSEC-2026-3241 Crash when type cannot be specialized in Tensorflow

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

Out of bounds read in Tensorflow

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:pythonimport tensorflow as [email protected] test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -10...

PYSEC-2026-3121 Out of bounds read in Tensorflow

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -...

Abort caused by allocating a vector that is too large in Tensorflow

ImpactDuring shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user:cc const auto numdims = Valueshapedim; std::vector dims; dims.reservenumdims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7.The...

PYSEC-2026-3113 Abort caused by allocating a vector that is too large in Tensorflow

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto numdims = Valueshapedim; std::vector dims; dims.reservenumdims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7. T...

PYSEC-2026-3159 Integer overflow in Tensorflow

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: python import tensorflow as tf input = tf.constant1,1,dtype=tf.qint32 @tf.function def test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...

Integer overflow in Tensorflow

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:pythonimport tensorflow as tfinput = tf.constant1,1,[email protected] test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...

PT-2026-59856

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& op def, const std::vector& input tensors, const std::vector& input tensors as shapes const auto ret = full type::SpecializeTypeattrs , op def;...

PT-2026-59732

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto num dims = Valueshape dim; std::vector dims; dims.reservenum dims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7...

PT-2026-59776

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: python import tensorflow as tf input = tf.constant1,1,dtype=tf.qint32 @tf.function def test: y = tf.raw ops.Dequantize input=input, min range=1.0, max range=10.0, mode='MIN COMBINED', narrow...

PT-2026-59828

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argumen...

PT-2026-59739

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batch dim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.raw ops.ReverseSequence input = 'aaa','bbb', seq lengths = 1,1,1, seq dim = -10, batch di...

Out-of-bounds Read

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Out-of-bounds Read through convPoolShapeInferenceopset19 in onnx/defs/nn/old.cc. An attacker can trigger the flaw by supplying a malformed convolution or pooling model that reaches the...

CVE-2026-14647

ONNX Runtime (onnxruntime) up to 1.21.x is affected by CVE-2026-14647 due to a weakness in convPoolShapeInference_opset19 in ONNX’s old.cc (onnx/defs/nn). The root cause is an out-of-bounds read introduced in this path, enabling remote exploitation. Public exploits exist per the description. Reme...

CVE-2026-14647 onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2021-41216

TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for Transpose is vulnerable to a heap buffer overflow. This occurs whenever perm contains negative elements. The shape inference function does not validate that the indices in perm are al...

CVE-2021-41218

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for AllToAll can be made to execute a division by 0. This occurs whenever the splitcount argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on...