CVE-2022-41886: TensorFlow ImageProjectiveTransformV2 Overflow Vulnerability
Summary
CVE-2022-41886: Overflow in ImageProjectiveTransformV2. Affects tensorflow across 3 version ranges.
< 2.8.4
>= 2.9.0, < 2.9.3
>= 2.10.0, < 2.10.1
Fixed in 2.8.4, 2.9.3 or 2.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2022-41886 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for building and training machine learning models. It provides a comprehensive ecosystem of tools, libraries, and community resources that allow developers to create complex neural networks and perform various data processing tasks. The framework includes numerous operations for image processing, one of which is ImageProjectiveTransformV2. This operation is designed to apply a projective transformation to images, but it is vulnerable to an overflow issue when provided with excessively large output shapes.
Vulnerability Detail
The vulnerability arises in the ImageProjectiveTransformV2 operation within TensorFlow when it is supplied with a large output shape. Specifically, this can lead to an overflow, potentially causing unexpected behavior or crashes in applications that rely on this function. The overflow occurs due to the way TensorFlow handles large integers, which can result in memory corruption or denial of service. This vulnerability can be exploited by attackers to manipulate image processing tasks, leading to potential data loss or application instability.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.42.8.4pip install --upgrade "tensorflow==2.8.4" -
>= 2.9.0, < 2.9.32.9.3pip install --upgrade "tensorflow==2.9.3" -
>= 2.10.0, < 2.10.12.10.1pip install --upgrade "tensorflow==2.10.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using excessively large output shapes with the ImageProjectiveTransformV2 operation. For example, instead of using an output shape like [1879048192, 1879048192], use a more reasonable size that your application can handle without causing overflow.
Conclusion
The CVE-2022-41886 vulnerability in TensorFlow's ImageProjectiveTransformV2 operation poses a significant risk when large output shapes are used. It is crucial to update to the patched versions of TensorFlow to mitigate this risk. Additionally, users can implement workarounds by avoiding large output shapes until they can upgrade.
See every vulnerability recorded for tensorflow →
FAQ
CVE-2022-41886 is a vulnerability in TensorFlow's ImageProjectiveTransformV2 operation that can lead to an overflow when large output shapes are specified.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to application crashes, data loss, or unexpected behavior during image processing tasks.
You can update TensorFlow by running the command: pip install --upgrade tensorflow==2.10.1 in your terminal or command prompt.
Yes, you can avoid this vulnerability by not using excessively large output shapes in the ImageProjectiveTransformV2 operation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
