Back to Database
Status published
Critical
CVE-2023-25668
TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation
Vulnerability Description
TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25668
Credits & Attribution
No credits recorded in the NVD database.
References
More from tensorflow
View All →CVE-2024-3660
Arbitrary code injection vulnerability in Keras framework < 2.13
Unknown
0
CVE-2023-33976
TensorFlow segfault in array_ops.upper_bound
High
7.5
CVE-2023-27579
TensorFlow has Floating Point Exception in TFLite in conv kernel
High
7.5
CVE-2023-25801
TensorFlow has double free in Fractional(Max/Avg)Pool
High
8
CVE-2023-25676
TensorFlow has null dereference on ParallelConcat with XLA
High
7.5
Affected Vendor
tensorflow
View all reports →Affected Software
tensorflow
Vulnerable Versions:
< 2.11.1
Timeline
Official Publish:
March 24th, 2023
Last Modified:
February 19th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK TTPs
T1203
Exploitation for Client Execution
Execution
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1055
Process Injection
Defense Evasion
T1190
Exploit Public-Facing Application
Initial Access
T1213
Data from Information Repositories
Collection
T1003
OS Credential Dumping
Credential Access
T1552
Unsecured Credentials
Credential Access