PT-2026-59977

Impact If LowerBound or UpperBound is given an emptysorted inputs input, it results in a nullptr dereference, leading to a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf out type = tf.int32 sorted inputs = tf.constant, shape=10,0, dtype=tf.float32...

PT-2026-59861

Impact If QuantizeDownAndShrinkRange is given nonscalar inputs for input min or input max, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf out type = tf.quint8 input = tf.constant1, shape=3, dtype=tf.qint32 input min = tf.constant,...

PT-2026-59874

Impact The RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the program. python...

PT-2026-59800

Impact If QuantizedInstanceNorm is given x min or x max tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf output range given = False given y min = 0 given y max = 0 variance epsilon = 1e-05 min separation =...

PT-2026-59878

Impact The implementation of AvgPoolGrad does not fully validate the input orig input shape. This results in a CHECK failure which can be used to trigger a denial of service attack: python import tensorflow as tf ksize = 1, 2, 2, 1 strides = 1, 2, 2, 1 padding = "VALID" data format = "NHWC" orig...

PT-2026-59833

Impact When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf import numpy as np arg 0=tf.constantvalue=np.random.randomsize=3, 3, 1, dtype=tf.float64 arg 1=tf.constantvalue=np.random.randint0,100,size=3, 3, 1,...

PT-2026-59920

Impact If FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf num bits = 8 narrow range = False inputs = tf.constant0, shape=4, dtype=tf.float32 mi...

PT-2026-59737

Impact If QuantizedMatMul is given nonscalar input for: - min a - max a - min b - max b It gives a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 transpose a = False transpose b = False Tactivation = tf.quint8 a = tf.constant7,...

PT-2026-59947

Impact If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. python import tensorflow as tf value = tf.constantshape=2, 1024, 1024, 1024...

PT-2026-59966

Impact When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf import numpy as np arg 0=tf.constantvalue=np.random.randomsize=3, 3, 1, dtype=tf.float64 arg 1=tf.constantvalue=np.random.randint0,100,size=3, 3, 1,...

PT-2026-59809

Impact If MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error. python import tensorflow as tf tf.raw ops.MirrorPadGradinput=1, paddings=0x77f00000,0xa000000, mode = 'REFLECT' Patches We have patched the issue in GitHub commit...

PT-2026-59946

Impact If MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error. python import tensorflow as tf tf.raw ops.MirrorPadGradinput=1, paddings=0x77f00000,0xa000000, mode = 'REFLECT' Patches We have patched the issue in GitHub commit...

PT-2026-59799

Impact A malicious invalid input crashes a tensorflow model Check Failed and can be used to trigger a denial of service attack. To minimize the bug, we built a simple single-layer TensorFlow model containing a Convolution3DTranspose layer, which works well with expected inputs and can be deployed...

PT-2026-59987

Impact If QuantizeDownAndShrinkRange is given nonscalar inputs for input min or input max, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf out type = tf.quint8 input = tf.constant1, shape=3, dtype=tf.qint32 input min = tf.constant,...

PT-2026-59811

Impact If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. python import tensorflow as tf value = tf.constantshape=2, 1024, 1024, 1024...

PT-2026-59753

Impact tf.keras.losses.poisson receives a y pred and y true that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. python import numpy as np import tensorflow as tf true value =...

PT-2026-59954

Impact If SparseFillEmptyRowsGrad is given empty inputs, TensorFlow will crash. python import tensorflow as tf tf.raw ops.SparseFillEmptyRowsGrad reverse index map=, grad values=, name=None Patches We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will b...

PT-2026-59734

Impact When ctx-step containter is a null ptr, the Lookup function will be executed with a null pointer. python import tensorflow as tf tf.raw ops.TensorArrayConcatV2handle='a', 'b', flow in = 0.1, dtype=tf.int32, element shape except0=1 Patches We have patched the issue in GitHub commit...

PT-2026-59897

Impact When ctx-step containter is a null ptr, the Lookup function will be executed with a null pointer. python import tensorflow as tf tf.raw ops.TensorArrayConcatV2handle='a', 'b', flow in = 0.1, dtype=tf.int32, element shape except0=1 Patches We have patched the issue in GitHub commit...

PT-2026-59204

Summary TensorFlow / Keras continues to honor HDF5 “external storage” and ExternalLink features when loading weights. A malicious .weights.h5 or a .keras archive embedding such weights can direct load weights to read from an arbitrary readable filesystem path. The bytes pulled from that path...