Every CVE Search/ Get API key

CVE-2018-7576

Null pointer dereference in TensorFlow leads to exploitation

6.5 MediumFix available

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
CVE-2018-7576
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
CVE-2018-7576
Updated
2026-11-02
EUVDEUVD-2019-0139 No score

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
EUVD-2019-0139
Updated
2026-11-03
GitHub AdvisoriesGHSA-jfq2-rj7f-9gvf 7.1

Null pointer dereference in TensorFlow leads to exploitation

Google TensorFlow 1.0.0 through 1.5.1 is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
GHSA-jfq2-rj7f-9gvf
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 6.5

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
CVE-2018-7576
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-jfq2-rj7f-9gvf 7.1

Null pointer dereference in TensorFlow leads to exploitation

Google TensorFlow 1.0.0 through 1.5.1 is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
GHSA-jfq2-rj7f-9gvf
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVPYSEC-2019-206 No score

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
PYSEC-2019-206
Updated
2026-11-02
OSVPYSEC-2019-224 No score

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
PYSEC-2019-224
Updated
2026-11-02
OSVPYSEC-2019-231 No score

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

Record
PYSEC-2019-231
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 1.0.0 up to 1.6.0
1.6.0
tensorflow-gpu
PyPI
 1.0.0 up to 1.6.0
1.6.0
tensorflow
PyPI
 1.0.0 up to 1.6.0, plus listed versions
1.0.11.1.01.2.01.2.11.3.0
Show 4 moreShow less
1.4.01.4.11.5.01.5.1
1.6.0
tensorflow-gpu
PyPI
 1.0.0 up to 1.6.0, plus listed versions
1.0.11.1.01.2.01.2.11.3.0
Show 4 moreShow less
1.4.01.4.11.5.01.5.1
1.6.0
tensorflow
PyPI
 before 1.7.0rc0, plus listed versions
0.12.00.12.0rc00.12.0rc10.12.11.0.0
Show 25 moreShow less
1.0.11.1.01.1.0rc01.1.0rc11.1.0rc21.2.01.2.0rc01.2.0rc11.2.0rc21.2.11.3.01.3.0rc01.3.0rc11.3.0rc21.4.01.4.0rc01.4.0rc11.4.11.5.01.5.0rc01.5.0rc11.5.11.6.01.6.0rc01.6.0rc1
1.7.0rc0
tensorflow-cpu
PyPI
 before 1.7.0rc0
1.7.0rc0
tensorflow-gpu
PyPI
 before 1.7.0rc0, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 8 moreShow less
1.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.0
1.7.0rc0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-7576 is a medium vulnerability (CVSS 6.5) in Google Tensorflow, published April 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in tensorflow 1.6.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open