CVE-2020-15195: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` use
Summary
TensorFlow versions before 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 contain a heap buffer overflow (a type of memory error where a program writes data outside its allocated memory space) in the `SparseFillEmptyRowsGrad` function. The bug occurs because of incorrect array indexing that allows `reverse_index_map(i)` to access memory beyond the bounds of `grad_values`, potentially causing the program to crash or behave unexpectedly.
Solution / Mitigation
Update TensorFlow to version 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1 or later. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54.
Vulnerability Details
8.5(high)
EPSS: 0.4%
Classification
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2020-15195
First tracked: February 15, 2026 at 08:38 PM
Classified by LLM (prompt v3) · confidence: 92%