CVE-2019-16778: Heap Buffer Overflow in TensorFlow
Summary
CVE-2019-16778: In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. Affects tensorflow across 2 version ranges.
>= 1.0.0, < 1.15.0
< db4f9717c41bccc3ce10099ab61996b246099892
Fixed in db4f9717c41bccc3ce10099ab61996b246099892. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2019-16778 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, prior to version 1.15, TensorFlow was susceptible to a heap buffer overflow vulnerability in the UnsortedSegmentSum function when the Index template argument was set to int32. This vulnerability could result in accessing out-of-bounds heap memory due to truncation of data_size and num_segments fields from int64 to int32, leading to potential memory corruption.
Vulnerability Detail
The vulnerability in TensorFlow arises from a heap buffer overflow in the UnsortedSegmentSum function. When the Index template argument is set to int32, the data_size and num_segments fields are truncated from int64 to int32. This truncation can produce negative numbers, causing the function to access out-of-bounds heap memory. While the exploitability of this vulnerability is unlikely, it was detected and fixed internally in TensorFlow versions 1.15 and 2.0. The impact of this vulnerability could potentially lead to memory corruption and unpredictable behavior of TensorFlow applications.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
db4f9717c41bccc3ce10099ab61996b246099892
This is the first release that contains the fix.
pip install --upgrade "tensorflow==db4f9717c41bccc3ce10099ab61996b246099892"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The heap buffer overflow vulnerability in TensorFlow, identified as CVE-2019-16778, could potentially lead to memory corruption and unpredictable behavior of TensorFlow applications. It is recommended to update to TensorFlow version 1.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The vulnerability could potentially lead to memory corruption and unpredictable behavior of TensorFlow applications.
While the exploitability of this vulnerability is unlikely, it is still recommended to update to the fixed versions of TensorFlow to ensure the security and stability of applications.
To fix this vulnerability, update TensorFlow to version 1.15 or later by following the official upgrade instructions provided by the TensorFlow project.
More information about this vulnerability can be found in the PYSEC-2019-209.yaml file in the advisory-database GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
