CVE-2022-23592
Published: 04 February 2022
Summary
CVE-2022-23592 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Tensorflow. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Deep Learning Frameworks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0285
Vulnerability details
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx`…
more
variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Deep Learning Frameworks
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: tensorflow, machine learning, tensorflow, tensorflow
Related Threats
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.