CVE-2020-15200: In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input argume
mediumvulnerability
security
Summary
TensorFlow versions before 2.3.1 have a bug in the `RaggedCountSparseOutput` function where it doesn't properly check that input data is valid, which can cause a heap buffer overflow (unsafe memory access that corrupts data). If the first value in the `splits` tensor (a structure that partitions data) isn't 0, the program crashes with a segmentation fault (an error when accessing memory illegally).
Solution / Mitigation
Update TensorFlow to version 2.3.1 or later, which includes the patch released in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02.
Vulnerability Details
CVSS Score
5.9(medium)
EPSS (30-day exploit probability)
EPSS: 0.3%
Classification
Attack SophisticationModerate
Impact (CIA+S)
integrityavailability
AI Component TargetedFramework
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2020-15200
First tracked: February 15, 2026 at 08:38 PM
Classified by LLM (prompt v3) · confidence: 95%