Every CVE Search/ Get API key

CVE-2023-25660

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

7.5 HighFix available

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Up 0.4 points since Mar 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
CVE-2023-25660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2023-1082 7.5

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
EUVD-2023-1082
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qjqc-vqcf-5qvj 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

Record
GHSA-qjqc-vqcf-5qvj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 7.5

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
CVE-2023-25660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVAZL-31202 7.5

CVE-2023-25660 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
AZL-31202
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-35306 7.5

CVE-2023-25660 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
AZL-35306
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
CVE-2023-25660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVGHSA-qjqc-vqcf-5qvj 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

Record
GHSA-qjqc-vqcf-5qvj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVPYSEC-2026-1963 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

Record
PYSEC-2026-1963
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-3231 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

Record
PYSEC-2026-3231
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-3362 7.5

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact

When the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault.

import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)

Patches

We have patched the issue in GitHub commit 6d423b8bcc9aa9f5554dc988c1c16d038b508df1.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team

Record
PYSEC-2026-3362
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-tensorflow-2023-25660 No score

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter summarize of tf.raw_ops.Print is zero, the new method SummarizeArray<bool> will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

Record
BIT-tensorflow-2023-25660
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 2.11.1
2.11.1
tensorflow-cpu
PyPI
 before 2.11.1
2.11.1
tensorflow-gpu
PyPI
 before 2.11.1
2.11.1
tensorflow
Azure Linux:2
 before 2.11.1-1
2.11.1-1
tensorflow
Azure Linux:3
 before 2.11.1-1
2.11.1-1
tensorflow
Bitnami
 before 2.12.0
2.12.0
tensorflow
PyPI
 before 2.11.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 45 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc1
2.11.1
tensorflow-cpu
PyPI
 before 2.11.1, plus listed versions
1.15.02.1.02.1.12.1.22.1.3
Show 45 moreShow less
2.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc12.11.0rc22.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.6.02.6.12.6.22.6.32.6.42.6.52.7.02.7.12.7.22.7.32.7.42.8.02.8.12.8.22.8.32.8.4
2.11.1
tensorflow-gpu
PyPI
 before 2.11.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 45 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc1
2.11.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25660 is a high vulnerability (CVSS 7.5) in Google Tensorflow, published March 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in tensorflow 2.11.1.

References

This page doesn't list everything

Left out here: 102 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open