CVE-2022-23585: Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak i
mediumvulnerability
security
Summary
TensorFlow, an open-source machine learning framework, has a memory leak (unused memory that is not freed) when decoding invalid PNG image files. The problem occurs because error-handling code exits the function early without properly freeing allocated buffers (chunks of memory that were set aside for use).
Solution / Mitigation
The fix will be included in TensorFlow 2.8.0. The fix will also be applied to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
Vulnerability Details
CVSS Score
4.3(medium)
EPSS (30-day exploit probability)
EPSS: 0.7%
Classification
Attack SophisticationModerate
Impact (CIA+S)
availability
AI Component TargetedFramework
Taxonomy References
CWE (Weakness Type)
Affected Vendors
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-23585
First tracked: February 15, 2026 at 08:40 PM
Classified by LLM (prompt v3) · confidence: 95%