CVE-2023-25801
HIGHGoogle Tensorflow < 2.12.0 - Double Free
Title source: ruleDescription
TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.
Scores
CVSS v3
8.0
EPSS
0.0008
EPSS Percentile
23.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Classification
CWE
CWE-415
Status
published
Affected Products (4)
google/tensorflow
< 2.12.0
pypi/tensorflow
< 2.11.1PyPI
pypi/tensorflow-cpu
< 2.11.1PyPI
pypi/tensorflow-gpu
< 2.11.1PyPI
Timeline
Published
Mar 25, 2023
Tracked Since
Feb 18, 2026