CVE-2023-25668
Published: 25 March 2023
Summary
CVE-2023-25668 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Tensorflow. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 18.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Deep Learning Frameworks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1018
Vulnerability details
TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will…
more
be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Deep Learning Frameworks
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: tensorflow, machine learning, tensorflow, tensorflow, tensorflow
Related Threats
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.