CVE-2018-21233: Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory
Summary
CVE-2018-21233: Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory. Affects tensorflow versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2018-21233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning framework widely used for developing and training deep learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning applications. TensorFlow versions prior to 1.7.0 are affected by a vulnerability that can result in an out-of-bounds read, potentially leading to the disclosure of process memory. This vulnerability specifically affects the DecodeBmp feature of the BMP decoder in the core/kernels/decode_bmp_op.cc file.
Vulnerability Detail
The vulnerability in TensorFlow arises due to an integer overflow, which triggers an out-of-bounds read. An attacker could exploit this vulnerability to access the contents of the process memory, potentially leading to the exposure of sensitive information. The issue is rated as moderate severity with a CVSS score of 6.5. It is important to note that this vulnerability is present in TensorFlow versions prior to 1.7.0.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.0
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is highly recommended to apply the fix by updating TensorFlow to the latest version.
Conclusion
The vulnerability in TensorFlow versions prior to 1.7.0 can lead to an out-of-bounds read, potentially disclosing the contents of process memory. It is crucial to update TensorFlow to version 1.7.0 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework used for developing and training deep learning models.
The vulnerability can result in the disclosure of process memory, potentially exposing sensitive information.
The vulnerability is rated as moderate severity with a CVSS score of 6.5.
To fix this vulnerability, update TensorFlow to version 1.7.0 or later.
There is no known workaround for this vulnerability. It is recommended to update TensorFlow to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
