CVE-2022-21726: Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the
Summary
TensorFlow, an open-source machine learning framework, has a bug in its `Dequantize` function where the `axis` parameter (which specifies which dimension to operate on) isn't properly validated. This allows attackers to read past the end of an array in memory, potentially causing crashes or exposing sensitive data through a heap OOB (out-of-bounds) access, which means reading memory locations outside the intended storage area.
Solution / Mitigation
The fix will be included in TensorFlow 2.8.0. The vulnerability will also be patched in TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3 through backported commits (cherrypicks).
Vulnerability Details
8.1(high)
EPSS: 0.3%
Classification
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-21726
First tracked: February 15, 2026 at 08:40 PM
Classified by LLM (prompt v3) · confidence: 95%