CVE-2022-36015: TensorFlow Integer Overflow Vulnerability in Math Operations
Summary
CVE-2022-36015: TensorFlow vulnerable to integer overflow in math ops. Affects tensorflow-cpu across 3 version ranges.
< 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fixed in 2.7.2, 2.8.1 or 2.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-36015 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for building and training machine learning models. It provides a comprehensive ecosystem for developing deep learning applications with key features such as flexibility, scalability, and a robust set of tools for model deployment. However, TensorFlow is susceptible to an integer overflow vulnerability in its mathematical operations, which can lead to application crashes under certain conditions.
Vulnerability Detail
The vulnerability arises in the RangeSize function of TensorFlow's math operations, where it fails to adequately check if the computed size fits within the limits of an int64_t data type. When the function receives values that exceed these limits, it can cause the application to crash. This issue can be exploited by providing inputs that lead to calculations resulting in sizes greater than the maximum allowable int64_t value, potentially disrupting the functionality of applications relying on TensorFlow.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.22.7.2pip install --upgrade "tensorflow-cpu==2.7.2" -
>= 2.8.0, < 2.8.12.8.1pip install --upgrade "tensorflow-cpu==2.8.1" -
>= 2.9.0, < 2.9.12.9.1pip install --upgrade "tensorflow-cpu==2.9.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update to the patched version as soon as it becomes available.
Conclusion
The integer overflow vulnerability in TensorFlow (CVE-2022-36015) poses a significant risk to applications utilizing the library for mathematical operations. Users are strongly encouraged to update to the latest patched versions to mitigate potential crashes and ensure the stability of their applications.
See every vulnerability recorded for tensorflow-cpu →
FAQ
CVE-2022-36015 is a vulnerability in TensorFlow that allows for integer overflow in mathematical operations, potentially causing application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions include TensorFlow 2.7.0, 2.8.0, and 2.9.0. Users should upgrade to 2.10.0 or the patched versions 2.9.1, 2.8.1, or 2.7.2.
If you do not update, your application may experience crashes when processing certain inputs that trigger the integer overflow vulnerability.
For more information regarding TensorFlow's security model and how to report issues, please consult their security guide available on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
