Every CVE Search/ Get API key

CVE-2023-25676

TensorFlow has null dereference on ParallelConcat with XLA

7.5 HighFix available

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Up 0.4 points since Mar 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

TensorFlow has null dereference on ParallelConcat with XLA

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
CVE-2023-25676
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2023-0913 7.5

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
EUVD-2023-0913
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6wfh-89q8-44jq 7.5

TensorFlow has null dereference on ParallelConcat with XLA

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

Record
GHSA-6wfh-89q8-44jq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 7.5

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
CVE-2023-25676
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVAZL-31203 7.5

CVE-2023-25676 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
AZL-31203
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-35321 7.5

CVE-2023-25676 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
AZL-35321
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV 7.5

TensorFlow has null dereference on ParallelConcat with XLA

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
CVE-2023-25676
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVGHSA-6wfh-89q8-44jq 7.5

TensorFlow has null dereference on ParallelConcat with XLA

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

Record
GHSA-6wfh-89q8-44jq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVPYSEC-2026-3123 7.5

TensorFlow has null dereference on ParallelConcat with XLA

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

Record
PYSEC-2026-3123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-3287 7.5

TensorFlow has null dereference on ParallelConcat with XLA

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

Record
PYSEC-2026-3287
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-961 7.5

TensorFlow has null dereference on ParallelConcat with XLA

Impact

When running with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit da66bc6d5ff466aee084f9e7397980a24890cd15.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx of 360 AIVul Team

Record
PYSEC-2026-961
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-tensorflow-2023-25676 No score

TensorFlow has null dereference on ParallelConcat with XLA

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Record
BIT-tensorflow-2023-25676
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 2.11.1
2.11.1
tensorflow-cpu
PyPI
 before 2.11.1
2.11.1
tensorflow-gpu
PyPI
 before 2.11.1
2.11.1
tensorflow
Azure Linux:2
 before 2.11.1-1
2.11.1-1
tensorflow
Azure Linux:3
 before 2.11.1-1
2.11.1-1
tensorflow
Bitnami
 before 2.12.0
2.12.0
tensorflow
PyPI
 before 2.11.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 45 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc1
2.11.1
tensorflow-cpu
PyPI
 before 2.11.1, plus listed versions
1.15.02.1.02.1.12.1.22.1.3
Show 45 moreShow less
2.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc12.11.0rc22.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.6.02.6.12.6.22.6.32.6.42.6.52.7.02.7.12.7.22.7.32.7.42.8.02.8.12.8.22.8.32.8.4
2.11.1
tensorflow-gpu
PyPI
 before 2.11.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 45 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.10.02.10.0rc02.10.0rc12.10.0rc22.10.0rc32.10.12.11.02.11.0rc02.11.0rc1
2.11.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25676 is a high vulnerability (CVSS 7.5) in Google Tensorflow, published March 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in tensorflow 2.11.1.

References

This page doesn't list everything

Left out here: 102 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open