CVE-2021-41203
Missing validation during checkpoint loading
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Missing validation during checkpoint loading
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
CVE-2021-41203- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2021-0426
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
EUVD-2021-0426- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7pxj-m4jf-r6h2
Missing validation during checkpoint loading
Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow.
This is because the checkpoints loading infrastructure is missing validation for invalid file formats.
Patches
We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578.
These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
- Record
GHSA-7pxj-m4jf-r6h2- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-345
- Updated
- 2026-11-02
NVD
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
CVE-2021-41203- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-345, CWE-190
- Updated
- 2026-11-02
OSV
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
CVE-2021-41203- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-7pxj-m4jf-r6h2
Missing validation during checkpoint loading
Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow.
This is because the checkpoints loading infrastructure is missing validation for invalid file formats.
Patches
We have patched the issue in GitHub commits b619c6f865715ca3b15ef1842b5b95edbaa710ad, e8dc63704c88007ee4713076605c90188d66f3d2, 368af875869a204b4ac552b9ddda59f6a46a56ec, and abcced051cb1bd8fb05046ac3b6023a7ebcc4578.
These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
- Record
GHSA-7pxj-m4jf-r6h2- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-345
- Updated
- 2026-11-02
Show 5 moreShow less
OSVBIT-tensorflow-2021-41203No score
Missing validation during checkpoint loading
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
BIT-tensorflow-2021-41203- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2021-396No score
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-396- Updated
- 2026-11-02
OSVPYSEC-2021-613No score
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-613- Updated
- 2026-11-02
OSVPYSEC-2021-811No score
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-811- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI | 2.6.0 up to 2.6.1 | 2.6.1 |
tensorflowPyPI | 2.5.0 up to 2.5.2 | 2.5.2 |
tensorflowPyPI | before 2.4.4 | 2.4.4 |
tensorflow-cpuPyPI | 2.6.0 up to 2.6.1 | 2.6.1 |
tensorflow-cpuPyPI | 2.5.0 up to 2.5.2 | 2.5.2 |
tensorflow-cpuPyPI | before 2.4.4 | 2.4.4 |
tensorflow-gpuPyPI | 2.6.0 up to 2.6.1 | 2.6.1 |
tensorflow-gpuPyPI | 2.5.0 up to 2.5.2 | 2.5.2 |
tensorflow-gpuPyPI | before 2.4.4 | 2.4.4 |
tensorflowBitnami | before 2.4.4, 2.5.0 up to 2.5.2, 2.6.0 up to 2.6.1 | 2.4.42.5.22.6.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI | 2.5.0 up to 2.5.2, plus listed versions 2.5.1 | 2.5.2 |
tensorflowPyPI | before 2.4.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 45 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.4 | 2.4.4 |
tensorflow-cpuPyPI | 2.5.0 up to 2.5.2, plus listed versions 2.5.1 | 2.5.2 |
tensorflow-cpuPyPI | before 2.4.4, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 14 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.3 | 2.4.4 |
tensorflow-gpuPyPI | 2.5.0 up to 2.5.2, plus listed versions 2.5.1 | 2.5.2 |
tensorflow-gpuPyPI | before 2.4.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 45 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.4 | 2.4.4 |
tensorflowPyPI | before 2.4.4, 2.5.0 up to 2.5.2, 2.6.0 up to 2.6.1, 2.7.0rc0 up to 2.7.0, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 45 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.0rc02.2.0rc12.2.0rc22.2.0rc32.2.0rc42.2.12.2.22.2.3 | 2.4.42.5.22.6.12.7.0 |
tensorflow-cpuPyPI | before 2.4.4, 2.5.0 up to 2.5.2, 2.6.0 up to 2.6.1, 2.7.0rc0 up to 2.7.0, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 16 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.5.12.7.0rc1 | 2.4.42.5.22.6.12.7.0 |
tensorflow-gpuPyPI | before 2.4.4, 2.5.0 up to 2.5.2, 2.6.0 up to 2.6.1, 2.7.0rc0 up to 2.7.0, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 45 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.4 | 2.4.42.5.22.6.12.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41203 is a high vulnerability (CVSS 7.8) in Google Tensorflow, published November 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in tensorflow 2.6.1.
References
github.com/tensorflow/tensorflow/security/advisories/GHSA-7pxj-m4jf-r6h2
nvd.nist.gov/vuln/detail/CVE-2021-41203
Show 168 moreShow less
suse.com/security/cve/CVE-2020-10531
Left out here: 33 versions. The JSON record has them.