TensorFlow, an open source machine learning framework, has a bug in its shape inference for the `ReverseSequence` operation where it doesn't properly check if the `batch_dim` parameter is a negative number, allowing it to read memory outside the intended array bounds (a heap OOB read, or out-of-bounds read that accesses invalid memory). While the code checks that `batch_dim` isn't larger than the input rank, it fails to reject negative values that are too extreme, which can cause the program to access memory before the start of the array.
The fix will be included in TensorFlow 2.8.0 and will also be applied to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3 through cherrypicking (applying the same commit to older versions).
8.1(high)
EPSS: 1.1%
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-21728
First tracked: February 15, 2026 at 08:40 PM
Classified by LLM (prompt v3) · confidence: 95%