CVE-2020-15209: TensorFlow - Crafted TFLite Model Null Pointer Dereference
Summary
CVE-2020-15209: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. Affects tensorflow across 6 version ranges.
< 0b5662bc2be13a8c8f044d925d87fb6e56247cd8
< 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2020-15209 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and community resources to facilitate the development of AI applications. TensorFlow Lite (TFLite) is a lightweight version of TensorFlow designed for mobile and embedded devices. It allows developers to run machine learning models on resource-constrained platforms. TFLite models are serialized using the FlatBuffer format, which enables efficient storage and retrieval of data structures. However, a vulnerability in TFLite versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 allows a crafted TFLite model to force a node to have an input tensor backed by a nullptr buffer.
Vulnerability Detail
The vulnerability arises from a flaw in the flatbuffer serialization process of TFLite models. By modifying a buffer index in the serialized model, an attacker can convert a read-only tensor to a read-write one. The runtime assumes that these buffers are initialized with nullptr and written to before any possible read operation. However, since the crafted model does not include any instructions to write to the modified tensor, a null pointer dereference occurs when the runtime attempts to access it. This vulnerability can be exploited to cause a denial-of-service condition or potentially execute arbitrary code in the context of the TensorFlow Lite runtime.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.41.15.4pip install --upgrade "tensorflow==1.15.4" -
>= 2.0.0, < 2.0.32.0.3pip install --upgrade "tensorflow==2.0.3" -
>= 2.1.0, < 2.1.22.1.2pip install --upgrade "tensorflow==2.1.2" -
>= 2.2.0, < 2.2.12.2.1pip install --upgrade "tensorflow==2.2.1" -
>= 2.3.0, < 2.3.12.3.1pip install --upgrade "tensorflow==2.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can exercise caution when loading TFLite models from untrusted sources. It is advisable to validate the source and integrity of the model files before using them with TensorFlow Lite.
Conclusion
The vulnerability in TensorFlow Lite versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 allows a crafted TFLite model to trigger a null pointer dereference, potentially leading to a denial-of-service or arbitrary code execution. It is crucial to update to the patched versions of TensorFlow to mitigate this vulnerability. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow Lite is a lightweight version of TensorFlow designed for running machine learning models on resource-constrained devices such as mobile phones and embedded systems.
This vulnerability allows an attacker to trigger a null pointer dereference in the TensorFlow Lite runtime, potentially leading to a denial-of-service condition or arbitrary code execution.
To fix this vulnerability, update your TensorFlow installation to versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. You can upgrade TensorFlow by running the command: pip install --upgrade tensorflow.
As a temporary workaround, exercise caution when loading TFLite models from untrusted sources. Validate the source and integrity of the model files before using them with TensorFlow Lite.
You can find more information about this vulnerability in the TensorFlow advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow/PYSEC-2020-132.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
