What’s Vulnerable › Vulnerabilities

CVE-2022-23590: Crash due to erroneous `StatusOr` in Tensorflow

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-04 · updated 2026-06-17
• Weakness: CWE-754

Description

Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

Affected products

• tensorflow: before 2.7.1 — fixed in 2.7.1

How to fix

Upgrade to a fixed version: tensorflow 2.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L560-L567
• https://github.com/tensorflow/tensorflow/commit/955059813cc325dc1db5e2daa6221271406d4439
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pqrv-8r2f-7278
• https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L560-L567
• https://github.com/tensorflow/tensorflow/commit/955059813cc325dc1db5e2daa6221271406d4439
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pqrv-8r2f-7278

Get alerted when CVE-2022-23590 or the next vulnerability affects your stack