CVE-2018-7576: Null Pointer Dereference in TensorFlow leads to exploitation
Summary
CVE-2018-7576: Null pointer dereference in TensorFlow leads to exploitation. Affects tensorflow versions >= 1.0.0, < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2018-7576 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow versions 1.6.x and earlier are affected by a Null Pointer Dereference vulnerability. This vulnerability can be exploited in a context-dependent manner.
Vulnerability Detail
The Null Pointer Dereference vulnerability in TensorFlow allows an attacker to exploit a null pointer dereference, leading to a crash or potential code execution. This vulnerability can be triggered under specific circumstances, potentially allowing an attacker to gain unauthorized access or cause a denial of service. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to upgrade to the fixed version of TensorFlow as soon as possible.
Conclusion
In conclusion, the Null Pointer Dereference vulnerability in TensorFlow can be mitigated by upgrading to version 1.7.0 or later. It is important to promptly address this vulnerability to prevent potential exploitation and ensure the security of TensorFlow-based applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
A Null Pointer Dereference vulnerability occurs when a program attempts to access or dereference a null pointer, leading to a crash or potential code execution.
The vulnerability can be exploited in a context-dependent manner, under specific circumstances that trigger the null pointer dereference issue.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to TensorFlow version 1.7.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
