CVE-2023-25666: TensorFlow AudioSpectrogram Floating Point Exception Vulnerability
Summary
CVE-2023-25666: TensorFlow has Floating Point Exception in AudioSpectrogram. Affects tensorflow-cpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and artificial intelligence. It provides a flexible platform for building and deploying machine learning models. The library includes a range of functionalities, including audio processing capabilities through operations like AudioSpectrogram. However, certain versions of TensorFlow have been found to contain vulnerabilities that can lead to unexpected behavior, such as floating point exceptions.
Vulnerability Detail
The vulnerability arises from a flaw in the AudioSpectrogram operation within TensorFlow version 2.11.0. Specifically, the issue is located in the SpectrogramShapeFn function, where improper handling of the 'stride' parameter can lead to a floating point exception. If the stride is set to zero, it results in a division by zero during the computation of output length, potentially causing the application to crash or behave unpredictably. This vulnerability can be exploited by providing crafted input parameters, leading to denial of service or application instability.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-cpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid setting the 'stride' parameter to zero when calling the AudioSpectrogram function. Here is an example of how to correctly set the parameters:
import tensorflow as tf
para = {'input': tf.constant([[14.], [24.]], dtype=tf.float32), 'window_size': 1, 'stride': 1, 'magnitude_squared': False}
func = tf.raw_ops.AudioSpectrogram
@tf.function(jit_compile=True)
def fuzz_jit():
y = func(**para) return y
fuzz_jit()
Conclusion
In summary, CVE-2023-25666 is a significant vulnerability in TensorFlow's AudioSpectrogram function that can lead to floating point exceptions. Users are advised to update to the patched version to mitigate risks. Additionally, temporary workarounds can be employed to avoid the issue until an update can be applied.
See every vulnerability recorded for tensorflow-cpu →
FAQ
CVE-2023-25666 is a vulnerability in TensorFlow's AudioSpectrogram function that can lead to floating point exceptions due to improper handling of the stride parameter.
The vulnerability affects TensorFlow version 2.11.0. It has been patched in version 2.11.1 and later.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to application crashes or instability, resulting in denial of service.
You can update TensorFlow by running the command 'pip install --upgrade tensorflow-cpu' in your terminal or command prompt.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
