cve.bz

CVE-2020-26267

7.8 highEPSS 0.2%

High (7.8) in google tensorflow. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in tensorflow 1.15.5, 2.0.4, 2.1.3.

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

Severity

CVSS 3.1

7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE
CWE-125
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-c9f3-9wfr-wgh7PyPItensorflow<1.15.51.15.5
GHSA-c9f3-9wfr-wgh7PyPItensorflow>=2.0.0 <2.0.42.0.4
GHSA-c9f3-9wfr-wgh7PyPItensorflow>=2.1.0 <2.1.32.1.3
GHSA-c9f3-9wfr-wgh7PyPItensorflow>=2.2.0 <2.2.22.2.2
GHSA-c9f3-9wfr-wgh7PyPItensorflow>=2.3.0 <2.3.22.3.2
GHSA-c9f3-9wfr-wgh7PyPItensorflow-cpu<1.15.51.15.5
GHSA-c9f3-9wfr-wgh7PyPItensorflow-cpu>=2.0.0 <2.0.42.0.4
GHSA-c9f3-9wfr-wgh7PyPItensorflow-cpu>=2.1.0 <2.1.32.1.3
GHSA-c9f3-9wfr-wgh7PyPItensorflow-cpu>=2.2.0 <2.2.22.2.2
GHSA-c9f3-9wfr-wgh7PyPItensorflow-cpu>=2.3.0 <2.3.22.3.2
GHSA-c9f3-9wfr-wgh7PyPItensorflow-gpu<1.15.51.15.5
GHSA-c9f3-9wfr-wgh7PyPItensorflow-gpu>=2.0.0 <2.0.42.0.4
GHSA-c9f3-9wfr-wgh7PyPItensorflow-gpu>=2.1.0 <2.1.32.1.3
GHSA-c9f3-9wfr-wgh7PyPItensorflow-gpu>=2.2.0 <2.2.22.2.2
GHSA-c9f3-9wfr-wgh7PyPItensorflow-gpu>=2.3.0 <2.3.22.3.2
PYSEC-2020-140PyPItensorflow<1.15.5
>=2.0.0 <2.0.4
>=2.1.0 <2.1.3
>=2.2.0 <2.2.2
>=2.3.0 <2.3.2		1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2
PYSEC-2020-298PyPItensorflow-cpu<1.15.5
>=2.0.0 <2.0.4
>=2.1.0 <2.1.3
>=2.2.0 <2.2.2
>=2.3.0 <2.3.2		1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2
PYSEC-2020-333PyPItensorflow-gpu<1.15.5
>=2.0.0 <2.0.4
>=2.1.0 <2.1.3
>=2.2.0 <2.2.2
>=2.3.0 <2.3.2		1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2

References

Check your stackJSON