CVE-2020-15201: In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input argume
mediumvulnerability
security
Summary
TensorFlow versions before 2.3.1 have a bug in the `RaggedCountSparseOutput` function where it doesn't properly check that input arguments are valid ragged tensors (a special data structure for storing data with varying lengths). This missing validation can cause a heap buffer overflow (reading memory outside the allowed bounds), which could crash the program or potentially allow attackers to execute code.
Solution / Mitigation
Update TensorFlow to version 2.3.1 or later. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02.
Vulnerability Details
CVSS Score
4.8(medium)
EPSS (30-day exploit probability)
EPSS: 0.2%
Classification
Attack SophisticationModerate
Impact (CIA+S)
integrityavailability
AI Component TargetedFramework
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2020-15201
First tracked: February 15, 2026 at 08:38 PM
Classified by LLM (prompt v3) · confidence: 95%