CVE-2022-41880 json
ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow
published 2022-11-18 3 y ago modified 2026-09-08 2 mo ago also BIT-tensorflow-2022-41880 , EUVD-2022-7289 , GHSA-8w5g-3wcv-9g2j , PYSEC-2026-3140 , PYSEC-2026-3298 , PYSEC-2026-971
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_max`, a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Patch / fix
- pypi tensorflow 2.8.4, 2.9.3, 2.10.1
- pypi tensorflow-cpu 2.8.4, 2.9.3, 2.10.1
- pypi tensorflow-gpu 2.8.4, 2.9.3, 2.10.1
- bitnami tensorflow 2.8.4, 2.9.3, 2.10.1
- google tensorflow 2.8.4, 2.9.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| OSV | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tensorflow | >=2.10.0, <2.10.1 <2.8.4 >=2.9.0, <2.9.3 |
2.10.1 2.8.4 2.9.3 |
| pypi | tensorflow-cpu | >=2.10.0, <2.10.1 <2.8.4 >=2.9.0, <2.9.3 |
2.10.1 2.8.4 2.9.3 |
| pypi | tensorflow-gpu | >=2.10.0, <2.10.1 <2.8.4 >=2.9.0, <2.9.3 |
2.10.1 2.8.4 2.9.3 |
| bitnami | tensorflow | <2.8.4 >=2.9.0, <2.9.3 >=2.10.0, <2.10.1 |
2.8.4 2.9.3 2.10.1 |
Affected products
- tensorflow tensorflow
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
github.com
/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4
web, patch, third-party-advisory, advisory
-
github.com
/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j
web, exploit, third-party-advisory, advisory
-
github.com
/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41880
advisory, web
-
github.com
/tensorflow/tensorflow
package
-
pypi.org
/project/tensorflow
package
-
github.com
/advisories/GHSA-8w5g-3wcv-9g2j
advisory
-
pypi.org
/project/tensorflow-cpu
package
-
pypi.org
/project/tensorflow-gpu
package
Sources
- CVE List CVE-2022-41880
- GitHub Advisory GHSA-8w5g-3wcv-9g2j
- NVD CVE-2022-41880
- OSV BIT-tensorflow-2022-41880
- OSV PYSEC-2026-3140
- OSV PYSEC-2026-3298
- OSV PYSEC-2026-971
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.