CVE-2019-9635: NULL Pointer Dereference in Google TensorFlow
Summary
CVE-2019-9635: NULL Pointer Dereference in Google TensorFlow. Affects tensorflow versions >= 1.0.0, < 1.12.1. Fixed in 1.12.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2019-9635 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google TensorFlow is an open-source machine learning framework used for building and training various models. It provides a comprehensive ecosystem for developing and deploying machine learning applications. TensorFlow is widely adopted and utilized by researchers, developers, and organizations for a range of tasks, including image recognition, natural language processing, and deep learning. However, versions prior to 1.12.2 are vulnerable to a NULL pointer dereference issue when processing invalid GIF files.
Vulnerability Detail
The vulnerability in Google TensorFlow before version 1.12.2 arises from a NULL pointer dereference. This flaw can be exploited by supplying an invalid GIF file, which triggers the dereference and leads to a denial of service (DoS) condition. An attacker can potentially exploit this vulnerability to crash TensorFlow-based applications or services, causing disruption and potential loss of data. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.12.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of TensorFlow to mitigate the risk of exploitation.
Conclusion
The NULL pointer dereference vulnerability in Google TensorFlow before version 1.12.2 can lead to a denial of service (DoS) condition. It is crucial to update to the patched version of TensorFlow to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The vulnerability can lead to a denial of service (DoS) condition in TensorFlow-based applications or services, potentially causing disruption and data loss.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
No, only versions prior to 1.12.2 are affected. It is recommended to update to the latest version to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
