CVE-2023-25801

HIGH

Google Tensorflow < 2.12.0 - Double Free

Title source: rule

Description

TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.

Scores

CVSS v3 8.0
EPSS 0.0008
EPSS Percentile 23.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Classification

CWE
CWE-415
Status published

Affected Products (4)

google/tensorflow < 2.12.0
pypi/tensorflow < 2.11.1PyPI
pypi/tensorflow-cpu < 2.11.1PyPI
pypi/tensorflow-gpu < 2.11.1PyPI

Timeline

Published Mar 25, 2023
Tracked Since Feb 18, 2026