Out of bounds access in tensorflow-lite

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2020-15211: 0.92% estimated exploitation activity in the next 30 days; percentile 60.26 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact In TensorFlow Lite, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernelutil.cc#L36 However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative -1 value as index for these tensors: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82 This results in special casing during validation at model loading time:…

Published by the source

25 Sep 2020, 18:28 UTC

Last modified by the source

8 Jul 2026, 06:27 UTC

Source last checked

26 Oct 2026, 13:25 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-cvpc-8phh-8f45

2. Revision 2 · amended · 24 Oct 2026

   Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-cvpc-8phh-8f45

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-15211

Advisory: Out of bounds access in tensorflow-lite
IDs: CVE-2020-15211, GHSA-cvpc-8phh-8f45
Record: https://patchnext.com/advisories/cve-2020-15211 (revision 3, source checked 26 Oct 2026, 13:25 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: tensorflow 2.3.1, 2.2.1, 2.1.2, 2.0.3, 1.15.4; tensorflow-gpu 2.3.1, 2.2.1, 2.1.2, 2.0.3, 1.15.4; tensorflow-cpu 2.3.1, 2.2.1, 2.1.2, 2.0.3, 1.15.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI tensorflow: affected < 1.15.4; >= 2.0.0, < 2.0.3; >= 2.1.0, < 2.1.2; >= 2.2.0, <= 2.2.0; >= 2.3.0, <= 2.3.0; fixed in 2.0.3, 2.1.2, 1.15.4, 2.3.1, 2.2.1
- PyPI tensorflow-gpu: affected < 1.15.4; >= 2.0.0, < 2.0.3; >= 2.1.0, < 2.1.2; >= 2.2.0, <= 2.2.0; >= 2.3.0, <= 2.3.0; fixed in 2.0.3, 2.1.2, 1.15.4, 2.3.1, 2.2.1
- PyPI tensorflow-cpu: affected < 1.15.4; >= 2.0.0, < 2.0.3; >= 2.1.0, < 2.1.2; >= 2.2.0, <= 2.2.0; >= 2.3.0, <= 2.3.0; fixed in 2.0.3, 2.1.2, 1.15.4, 2.3.1, 2.2.1

## Suggested inspection (read-only)
- `python -m pip show tensorflow`: prints the installed version. Run with the environment that serves production active.
- `python -m pip show tensorflow-gpu`: prints the installed version. Run with the environment that serves production active.
- `python -m pip show tensorflow-cpu`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on tensorflow, tensorflow-gpu, tensorflow-cpu.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-cvpc-8phh-8f45 (OSV record GHSA-cvpc-8phh-8f45 lists affected ranges: PyPI tensorflow >=0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 =0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 =0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 <2.3.1 (fixed))
- Verified: https://github.com/advisories/GHSA-cvpc-8phh-8f45 (GitHub-reviewed advisory GHSA-cvpc-8phh-8f45 lists affected ranges: PyPI tensorflow >=0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 =0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 =0 =2.0.0 =2.1.0 =2.2.0 =2.3.0 <=2.3.0)

Commands are suggestions: review each one before running it.