Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-1m8h-cgum-nkd2
Vulnerability ID VCID-1m8h-cgum-nkd2
Aliases CVE-2022-36027
GHSA-79h2-q768-fpxr
Summary TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2022-36027
epss 0.00267 https://api.first.org/data/v1/epss?cve=CVE-2022-36027
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-79h2-q768-fpxr
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow
generic_textual MODERATE https://github.com/tensorflow/tensorflow
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
generic_textual MODERATE https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
ssvc Track https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/issues/53767
generic_textual MODERATE https://github.com/tensorflow/tensorflow/issues/53767
ssvc Track https://github.com/tensorflow/tensorflow/issues/53767
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
generic_textual MODERATE https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
cvssv3.1_qr MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
generic_textual MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
ssvc Track https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2022-36027
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-36027
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-36027
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
https://github.com/tensorflow/tensorflow/issues/53767
https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
https://nvd.nist.gov/vuln/detail/CVE-2022-36027
GHSA-79h2-q768-fpxr https://github.com/advisories/GHSA-79h2-q768-fpxr
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:44:16Z/ Found at https://github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/issues/53767
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:44:16Z/ Found at https://github.com/tensorflow/tensorflow/issues/53767
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:44:16Z/ Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-36027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.50355
EPSS Score 0.00267
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:12:23.666889+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0