CVE-2022-23558: Integer Overflow in TensorFlow
Summary
CVE-2022-23558: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< a1e1511dde36b3f8aa27a6ec630838e7ea40e091
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23558 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources to facilitate the development of AI applications. TensorFlow supports various platforms and languages, including Python, C++, and JavaScript. However, a vulnerability has been identified in TensorFlow that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability (CVE-2022-23558) in TensorFlow arises from an integer overflow in the TfLiteIntArrayCreate function. This vulnerability can be triggered by crafting a TFLite model with specific inputs that cause the computed_size variable to overflow the int data type. The TfLiteIntArrayGetSizeInBytes function returns an int instead of a size_t, which exacerbates the issue. An attacker with the ability to provide malicious inputs to TensorFlow could exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact of this vulnerability can be severe, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. The recommended approach is to update TensorFlow to the fixed versions.
Conclusion
The identified vulnerability in TensorFlow (CVE-2022-23558) poses a significant risk to systems utilizing the affected versions. It is crucial to promptly update TensorFlow to one of the fixed versions to mitigate the vulnerability and ensure the security of machine learning applications. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying AI models.
This vulnerability could allow attackers to execute arbitrary code or cause a denial-of-service condition, potentially leading to unauthorized access, data breaches, or system compromise.
The vulnerability affects TensorFlow versions 2.5.3, 2.6.3, and 2.7.1. These versions have been fixed in TensorFlow 2.8.0.
To fix this vulnerability, update your TensorFlow installation to one of the fixed versions: TensorFlow 2.8.0, TensorFlow 2.7.1, TensorFlow 2.6.3, or TensorFlow 2.5.3.
No specific workaround has been provided. It is recommended to update TensorFlow to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
