CVE-2022-23584: Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decod
highvulnerability
security
Summary
TensorFlow (an open-source machine learning framework) has a vulnerability where a malicious user can trigger a use after free bug (accessing memory that has already been freed) when decoding PNG images. The problem occurs because after a memory cleanup function is called, the width and height values are left in an unpredictable state.
Solution / Mitigation
Update to TensorFlow 2.8.0 or apply patches to the following supported versions: TensorFlow 2.7.1, TensorFlow 2.6.3, or TensorFlow 2.5.3. These versions contain the fix for this vulnerability.
Vulnerability Details
CVSS Score
7.6(high)
EPSS (30-day exploit probability)
EPSS: 0.3%
Classification
Attack SophisticationModerate
Impact (CIA+S)
integrityavailability
AI Component TargetedFramework
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-23584
First tracked: February 15, 2026 at 08:40 PM
Classified by LLM (prompt v3) · confidence: 95%