CVE-2022-36016: TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a
Summary
TensorFlow, an open source platform for machine learning, has a bug where a specific function (`tensorflow::full_type::SubstituteFromAttrs`) crashes the program instead of properly reporting an error when it receives incorrect input (a `FullTypeDef` that doesn't have exactly three arguments). This crash could potentially be exploited to make TensorFlow applications stop working.
Solution / Mitigation
The issue is patched in GitHub commit 6104f0d4091c260ce9352f9155f7e9b725eab012. The fix will be included in TensorFlow 2.10.0 and will also be applied to TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2.
Vulnerability Details
5.9(medium)
EPSS: 0.2%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-21727: Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulne
CVE-2026-22252: LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbi
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-36016
First tracked: February 15, 2026 at 08:41 PM
Classified by LLM (prompt v3) · confidence: 92%