Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-scvf-p5ff-c3df
Vulnerability ID VCID-scvf-p5ff-c3df
Aliases CVE-2022-41900
GHSA-xvwp-h6jv-7472
Summary TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01243 https://api.first.org/data/v1/epss?cve=CVE-2022-41900
epss 0.01243 https://api.first.org/data/v1/epss?cve=CVE-2022-41900
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-xvwp-h6jv-7472
cvssv3.1 7.1 https://github.com/tensorflow/tensorflow
generic_textual HIGH https://github.com/tensorflow/tensorflow
cvssv3.1 7.1 https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
generic_textual HIGH https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
cvssv3.1 7.1 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
cvssv3.1_qr HIGH https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
generic_textual HIGH https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2022-41900
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-41900
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-41900
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
https://nvd.nist.gov/vuln/detail/CVE-2022-41900
GHSA-xvwp-h6jv-7472 https://github.com/advisories/GHSA-xvwp-h6jv-7472
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-41900
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.79613
EPSS Score 0.01243
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:12:24.104088+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0