CVE-2021-29572: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.SdcaOptimizer`
Summary
TensorFlow, a machine learning platform, has a bug in the `tf.raw_ops.SdcaOptimizer` function where it crashes when given invalid input because it tries to access memory that doesn't exist (null pointer dereference, which is undefined behavior in programming). The code doesn't check that user inputs meet the function's requirements before processing them.
Solution / Mitigation
The fix will be included in TensorFlow 2.5.0. It will also be backported (applied retroactively) to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4, which are still in the supported range.
Vulnerability Details
2.5(low)
EPSS: 0.0%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2021-29572
First tracked: February 15, 2026 at 08:39 PM
Classified by LLM (prompt v3) · confidence: 95%