Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.

MEDIUM 6.5CVE-2018-21233 · GHSA-h98h-8mxr-m8gx · PYSEC-2020-253 · Published 04/05/2020 · updated 17/06/2026

In short

CVE-2018-21233 is a MEDIUM (CVSS 6.5) vulnerability affecting tensorflow, tensorflow-cpu, tensorflow-gpu.
Chance of exploitation in the next 30 days (EPSS): 0.59%, higher than 48.4% of all vulnerabilities.
Fix: update to 1.7.0 or later.

Package	Affected versions	Patched versions
tensorflow PyPI	`< 1.7.0`	`1.7.0`
tensorflow-cpu PyPI	`< 1.7.0`	`1.7.0`
tensorflow-gpu PyPI	`< 1.7.0`	`1.7.0`
tensorflow google	`< 1.7.0`	`1.7.0`

Description

TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.

NVD description