CVE-2019-16778: Heap buffer overflow in TensorFlow's UnsortedSegmentSum
Summary
CVE-2019-16778: Heap buffer overflow in UnsortedSegmentSum in TensorFlow. Affects tensorflow versions < 1.15.0. Fixed in 1.15.0. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2019-16778 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in the UnsortedSegmentSum function of TensorFlow, which can lead to a heap buffer overflow.
Vulnerability Detail
The vulnerability arises when the Index template argument of UnsortedSegmentSum is set to int32. Due to truncation from int64 to int32, the data_size and num_segments fields can become negative, resulting in accessing out-of-bounds heap memory. Although it is unlikely to be exploitable, it is recommended to update to TensorFlow 1.15 or 2.0 or later versions, as these versions have already fixed the issue.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.0
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.15.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in TensorFlow's UnsortedSegmentSum function can lead to a heap buffer overflow. It is recommended to update to TensorFlow 1.15 or 2.0 or later versions to mitigate this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
UnsortedSegmentSum is a TensorFlow function that performs a segmented sum operation on a given input tensor. It groups the elements based on a specified segment index and computes the sum within each segment.
The vulnerability occurs when the Index template argument of UnsortedSegmentSum is set to int32. This leads to truncation of data_size and num_segments fields, resulting in negative values and accessing out-of-bounds heap memory.
The vulnerability is unlikely to be exploitable. However, it is still recommended to update to the fixed versions of TensorFlow to ensure security.
To update TensorFlow, refer to the official TensorFlow documentation for installation and upgrading instructions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
