CVE-2021-29533: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a
Summary
TensorFlow has a vulnerability (CVE-2021-29533) where an attacker can crash the application by sending an empty image to the `tf.raw_ops.DrawBoundingBoxes` function. The bug exists because the code uses `CHECK` assertions (which crash the program on failure) instead of `OP_REQUIRES` (which returns an error message to the user) to validate user input, causing the program to abort when it receives invalid data.
Solution / Mitigation
The fix will be included in TensorFlow 2.5.0. The commit will also be backported to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4, which are still in the supported range.
Vulnerability Details
2.5(low)
EPSS: 0.0%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2021-29533
First tracked: February 15, 2026 at 08:38 PM
Classified by LLM (prompt v3) · confidence: 95%