CVE-2023-25662: TensorFlow Integer Overflow Vulnerability in EditDistance Function
Summary
CVE-2023-25662: TensorFlow vulnerable to integer overflow in EditDistance. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25662 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem for building and deploying machine learning models. It offers a wide range of tools and libraries for tasks such as deep learning, neural networks, and data processing. The framework is widely used in both research and production environments. However, a vulnerability has been identified in the EditDistance function, which can lead to integer overflow under specific conditions, potentially causing deadlocks.
Vulnerability Detail
The vulnerability arises from the EditDistance function in TensorFlow version 2.11.0, specifically in the array_ops.cc file. When the 'hypothesis_shape' input is empty, the calculation of 'hypothesis_shape_t->NumElements() - 1' results in an integer overflow. This overflow can lead to a deadlock situation, where the function hangs indefinitely. If exploited, this vulnerability can disrupt applications relying on TensorFlow for processing, leading to service interruptions and degraded performance.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to avoid passing empty 'hypothesis_shape' inputs to the EditDistance function until the package is updated.
Conclusion
The CVE-2023-25662 vulnerability in TensorFlow poses a significant risk due to potential integer overflow in the EditDistance function. Users are strongly encouraged to update to the patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-25662 is a vulnerability in TensorFlow that can cause integer overflow in the EditDistance function, leading to potential deadlocks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that could impact application performance.
If you cannot update TensorFlow, avoid using the EditDistance function with empty 'hypothesis_shape' inputs to mitigate the risk of encountering the vulnerability.
For more information regarding TensorFlow's security model and how to report issues, please consult their security guide available on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
