Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-f3cx-k63z-7qde
Vulnerability ID VCID-f3cx-k63z-7qde
Aliases CVE-2022-23559
GHSA-98p5-x8x4-c9m5
PYSEC-2022-123
PYSEC-2022-68
Summary Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-190 Integer Overflow or Wraparound
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00517 https://api.first.org/data/v1/epss?cve=CVE-2022-23559
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-98p5-x8x4-c9m5
cvssv3.1_qr HIGH https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98p5-x8x4-c9m5
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-23559
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-68.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-123.yaml
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/embedding_lookup_sparse.cc#L179-L189
https://github.com/tensorflow/tensorflow/commit/1de49725a5fc4e48f1a3b902ec3599ee99283043
https://github.com/tensorflow/tensorflow/commit/a4e401da71458d253b05e41f28637b65baf64be4
https://github.com/tensorflow/tensorflow/commit/f19be71717c497723ba0cea0379e84f061a75e01
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98p5-x8x4-c9m5
CVE-2022-23559 https://nvd.nist.gov/vuln/detail/CVE-2022-23559
GHSA-98p5-x8x4-c9m5 https://github.com/advisories/GHSA-98p5-x8x4-c9m5
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.67022
EPSS Score 0.00517
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:29:49.407294+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2022-68.yaml 38.6.0