CVE-2022-36012: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is giv
Summary
TensorFlow (an open source platform for machine learning) crashes when a specific internal function called `mlir::tfg::ConvertGenericFunctionToFunctionDef` receives empty function attributes (data describing how a function should behave). This is a reachable assertion vulnerability, meaning the program encounters an unexpected condition it cannot handle.
Solution / Mitigation
Update to TensorFlow 2.10.0, or apply the patch from GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. Users of earlier versions should also update to TensorFlow 2.9.1, 2.8.1, or 2.7.2, which will also include this fix.
Vulnerability Details
5.9(medium)
EPSS: 0.2%
Classification
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-36012
First tracked: February 15, 2026 at 08:41 PM
Classified by LLM (prompt v3) · confidence: 92%