https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:15:15.781999+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-tensorflow-2021-41226 BIT-tensorflow-2021-41226 — Heap OOB read in `SparseBinCount` 2026-10-06T14:15:15.790462+00:00

Affected: Bitnami: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/cnvd-2021-85883 cnvd-2021-85883 2026-10-06T14:15:15.790513+00:00 cnvd-2021-85883 https://cve.radiocsirt.org/vuln/euvd-2026-31595 EUVD-2026-31595 2026-10-06T14:15:15.790530+00:00 EUVD-2026-31595 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41226 fkie_cve-2021-41226 2026-10-06T14:15:15.790542+00:00

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/ghsa-374m-jm66-3vj8 GHSA-374m-jm66-3vj8 — Heap OOB in `SparseBinCount` 2026-10-06T14:15:15.790563+00:00

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/bincount_op.cc#L353-L417) of `SparseBinCount` is vulnerable to a heap OOB:

```python import tensorflow as tf tf.raw_ops.SparseBincount( indices=[[0],[1],[2]] values=[0,-10000000] dense_shape=[1,1] size=[1] weights=[3,2,1] binary_output=False) ```

This is because of missing validation between the elements of the `values` argument and the shape of the sparse output:

```cc for (int64_t i = 0; i < indices_mat.dimension(0); ++i) { const int64_t batch = indices_mat(i, 0); const Tidx bin = values(i); ... out(batch, bin) = ...; } ```

### Patches We have patched the issue in GitHub commit [f410212e373eb2aec4c9e60bf3702eba99a38aba](https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

 https://cve.radiocsirt.org/vuln/gsd-2021-41226 gsd-2021-41226 2026-10-06T14:15:15.790603+00:00 gsd-2021-41226 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12116-1 openSUSE-SU-2024:12116-1 — tensorflow-lite-2.9.1-1.1 on GA media 2026-10-06T14:15:15.790614+00:00

tensorflow-lite-2.9.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2021-418 PYSEC-2021-418 2026-10-06T14:15:15.790663+00:00

Affected: PyPI: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.