{"data":{"id":"0a00bbe6-694f-4045-889c-6f82103a5e3d","title":"CVE-2022-41902: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that…","summary":"CVE-2022-41902 affects TensorFlow, an open source machine learning platform. The function MakeGrapplerFunctionItem uses arguments that set input and output sizes, and when the given inputs are greater than or equal to the output sizes, it triggers an out-of-bounds memory read or a crash.","solution":"Patched in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0, and the commit will also be cherry-picked to TensorFlow 2.8.4, 2.9.3, and 2.10.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-41902","publishedAt":"2022-12-07T03:15:10.513Z","cveId":"CVE-2022-41902","cweIds":["CWE-787","CWE-125"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.8.4 (fixed: 2.8.4)","tensorflow@>= 2.9.0, < 2.9.3 (fixed: 2.9.3)","tensorflow@>= 2.10.0, < 2.10.1 (fixed: 2.10.1)","tensorflow-cpu@< 2.8.4 (fixed: 2.8.4)","tensorflow-gpu@< 2.8.4 (fixed: 2.8.4)","tensorflow-cpu@>= 2.9.0, < 2.9.3 (fixed: 2.9.3)","tensorflow-gpu@>= 2.9.0, < 2.9.3 (fixed: 2.9.3)","tensorflow-cpu@>= 2.10.0, < 2.10.1 (fixed: 2.10.1)","tensorflow-gpu@>= 2.10.0, < 2.10.1 (fixed: 2.10.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TensorFlow out-of-bounds memory read via MakeGrapplerFunctionItem","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00492,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-cg88-rpvp-cjv5"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:21.284Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-11-16T18:44:24.219Z","daysToFix":-21,"fixCheckedAt":"2026-10-29T21:47:28.690Z","capecIds":["CAPEC-100","CAPEC-540"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.9.3","matchedVersion":"2.9.3","fixReleasedAt":"2022-11-16T19:24:11.468Z","daysToFix":-21,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.9.3","matchedVersion":"2.9.3","fixReleasedAt":"2022-11-16T19:31:25.640Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.9.3","matchedVersion":"2.9.3","fixReleasedAt":"2022-11-16T19:25:59.532Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.10.1","matchedVersion":"2.10.1","fixReleasedAt":"2022-11-16T20:10:45.110Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.8.4","matchedVersion":"2.8.4","fixReleasedAt":"2022-11-16T18:44:24.219Z","daysToFix":-21,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.10.1","matchedVersion":"2.10.1","fixReleasedAt":"2022-11-16T20:05:33.350Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.8.4","matchedVersion":"2.8.4","fixReleasedAt":"2022-11-16T18:51:04.818Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.8.4","matchedVersion":"2.8.4","fixReleasedAt":"2022-11-16T18:46:03.386Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.10.1","matchedVersion":"2.10.1","fixReleasedAt":"2022-11-16T20:03:56.467Z","daysToFix":-21,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:28.537Z"}]}}