CVE-2018-7577: Google TensorFlow Memcpy Parameter Overlap Vulnerability
Summary
CVE-2018-7577: Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory. Affects tensorflow versions < 1.7.1. Fixed in 1.7.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2018-7577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google TensorFlow is an open-source machine learning framework used for developing and training deep learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning applications. The vulnerability in question affects versions of TensorFlow prior to 1.7.1. TensorFlow utilizes the Google Snappy library, which is responsible for compression and decompression operations. The vulnerability arises from a parameter overlap issue in the Memcpy function of the Snappy library, which can lead to crashes or unauthorized memory access within the process.
Vulnerability Detail
The vulnerability (CVE-2018-7577) originates from a parameter overlap in the Memcpy function of the Google Snappy library used by TensorFlow. This issue allows an attacker to crash the application or potentially read data from other parts of the process memory. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive information or disrupt the functioning of the TensorFlow application.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The CVE-2018-7577 vulnerability in Google TensorFlow poses a risk of crashes and unauthorized memory access. Upgrading to TensorFlow version 1.7.1 or later is crucial to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The vulnerability can result in crashes or unauthorized memory access within the TensorFlow application, potentially leading to data leakage or disruption of the application's functionality.
Versions of TensorFlow prior to 1.7.1 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and the tool will provide real-time alerts for open-source vulnerabilities, including this one.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version of TensorFlow.
You can find more information about this vulnerability in the TensorFlow advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow/PYSEC-2019-207.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
