CVE-2022-36015: TensorFlow Integer Overflow Vulnerability
Summary
CVE-2022-36015: TensorFlow vulnerable to integer overflow in math ops. Affects tensorflow across 3 version ranges.
< 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fixed in 2.7.2, 2.8.1 or 2.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2022-36015 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that could lead to an integer overflow in math operations.
Vulnerability Detail
The vulnerability in TensorFlow arises when the RangeSize function receives values that do not fit into an int64_t. This can result in a crash of the program. The issue is caused by a lack of proper bounds checking in the code. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) attack or execute arbitrary code.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.22.7.2pip install --upgrade "tensorflow==2.7.2" -
>= 2.8.0, < 2.8.12.8.1pip install --upgrade "tensorflow==2.8.1" -
>= 2.9.0, < 2.9.12.9.1pip install --upgrade "tensorflow==2.9.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the patch or update to the fixed versions of TensorFlow.
Conclusion
The TensorFlow Integer Overflow Vulnerability (CVE-2022-36015) is a critical issue that can lead to program crashes and potential security risks. It is crucial to update TensorFlow to the fixed versions or apply the provided patch to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The vulnerability can lead to a crash of the program, potentially causing a denial of service (DoS) attack or enabling an attacker to execute arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is important to apply the patch or update to the fixed versions of TensorFlow to mitigate any potential risks.
No, the recommended approach is to update TensorFlow to the fixed versions. Applying the patch or updating to the latest version ensures that the vulnerability is properly addressed.
For more information regarding the security model of TensorFlow and how to contact the TensorFlow team with any issues or questions, please consult the TensorFlow Security Guide (https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
