TI-2023-12289 Aliases CVE-2023-27579 GHSA-5w96-866f-6rm8

TensorFlow has Floating Point Exception in TFLite in conv kernel

LOW 39CWE-697Published 2023-03-24 · Updated 2025-02-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Fix Fixed tensorflow (tensorflow): 2.11.1tensorflow (PyPI): 2.11.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Google	tensorflow	before 2.11.1	2.11.1	Patch available	CNA
—	tensorflow (PyPI)	before 2.11.1	2.11.1	Patch available	GHSA-5w96-866f-6rm8
—	tensorflow-cpu (PyPI)	before 2.11.1	2.11.1	Patch available	GHSA-5w96-866f-6rm8
—	tensorflow-gpu (PyPI)	before 2.11.1	2.11.1	Patch available	GHSA-5w96-866f-6rm8

tensorflow VendorGoogle Affected before 2.11.1 Fixed in 2.11.1 Patch available CNA
tensorflow (PyPI) Vendor— Affected before 2.11.1 Fixed in 2.11.1 Patch available GHSA-5w96-866f-6rm8
tensorflow-cpu (PyPI) Vendor— Affected before 2.11.1 Fixed in 2.11.1 Patch available GHSA-5w96-866f-6rm8
tensorflow-gpu (PyPI) Vendor— Affected before 2.11.1 Fixed in 2.11.1 Patch available GHSA-5w96-866f-6rm8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:google:tensorflow::::::::	before 2.12.0	Vulnerable	Google

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* Versions before 2.12.0 Vulnerable ·Google

Remediation

Fix · CNA tensorflow (tensorflow) Fixed in 2.11.1
Fix · GHSA-5w96-866f-6rm8 tensorflow (PyPI) Fixed in 2.11.1 Advisory →
Fix · GHSA-5w96-866f-6rm8 tensorflow-cpu (PyPI) Fixed in 2.11.1 Advisory →
Fix · GHSA-5w96-866f-6rm8 tensorflow-gpu (PyPI) Fixed in 2.11.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-27579
2026-10-03 Alias added: GHSA-5w96-866f-6rm8

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-27579

Other 1

https://github.com/tensorflow/tensorflow

TI-2022-20241 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow CVSS 3.1CRITICAL 9.8
TI-2022-07640 Integer overflow in Tensorflow CVSS 3.1CRITICAL 9.8
TI-2022-07627 Out of bounds read and write in Tensorflow CVSS 3.1HIGH 8.8
TI-2022-07619 Out of bounds write in Tensorflow CVSS 3.1HIGH 8.8
TI-2022-07613 Read and Write outside of bounds in TFLite CVSS 3.1HIGH 8.8
TI-2022-07612 Integer overflow in TFLite CVSS 3.1HIGH 8.8

See all 430 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences