Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vfgz-fss4-wbgu
Vulnerability ID VCID-vfgz-fss4-wbgu
Aliases BIT-tensorflow-2022-23574
CVE-2022-23574
GHSA-77gp-3h4r-6428
PYSEC-2022-138
PYSEC-2022-83
Summary Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00296 https://api.first.org/data/v1/epss?cve=CVE-2022-23574
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-77gp-3h4r-6428
cvssv3.1_qr HIGH https://github.com/tensorflow/tensorflow/security/advisories/GHSA-77gp-3h4r-6428
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-23574
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-83.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-138.yaml
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102
https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-77gp-3h4r-6428
CVE-2022-23574 https://nvd.nist.gov/vuln/detail/CVE-2022-23574
GHSA-77gp-3h4r-6428 https://github.com/advisories/GHSA-77gp-3h4r-6428
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.53147
EPSS Score 0.00296
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:29:42.174986+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-gpu/PYSEC-2022-138.yaml 38.6.0