CVE-2023-25666: TensorFlow GPU Floating Point Exception in AudioSpectrogram
Summary
CVE-2023-25666: TensorFlow has Floating Point Exception in AudioSpectrogram. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem for building and deploying machine learning models. It is widely used for various applications, including deep learning and neural networks. The TensorFlow GPU package enhances performance by utilizing GPU resources for computation. However, like any complex software, it can have vulnerabilities that may affect its stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2023-25666 in TensorFlow GPU arises from a Floating Point Exception in the AudioSpectrogram operation. This issue originates from improper handling of input parameters, specifically when the stride attribute is set to zero. This can lead to a division by zero error, resulting in application crashes or undefined behavior. The vulnerability is present in version 2.11.0 of TensorFlow and can be exploited by providing specific input parameters that trigger the faulty logic in the AudioSpectrogram function.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using a stride value of zero when calling the AudioSpectrogram function. Here is an example of how to correctly set the parameters:
import tensorflow as tf
para = {'input': tf.constant([[14.], [24.]], dtype=tf.float32), 'window_size': 1, 'stride': 1, 'magnitude_squared': False}
func = tf.raw_ops.AudioSpectrogram
@tf.function(jit_compile=True)
def fuzz_jit():
y = func(**para) return y
fuzz_jit()
Conclusion
CVE-2023-25666 is a significant vulnerability in TensorFlow GPU that can lead to application crashes due to a Floating Point Exception. Users are encouraged to update to the patched version to mitigate risks. For those unable to update immediately, adjusting the stride parameter can serve as a temporary workaround.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-25666 is a vulnerability in TensorFlow GPU that can lead to a Floating Point Exception in the AudioSpectrogram operation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The vulnerability affects TensorFlow GPU version 2.11.0. It has been patched in version 2.11.1 and later.
As a temporary measure, ensure that you do not use a stride value of zero when calling the AudioSpectrogram function.
The CVSS score for CVE-2023-25666 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
