Low severity2.6NVD Advisory· Published Dec 16, 2019· Updated Jun 17, 2026
CVE-2019-16778
CVE-2019-16778
Description
In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 1.15.0 | 1.15.0 |
tensorflow-cpuPyPI | < 1.15.0 | 1.15.0 |
tensorflow-gpuPyPI | < 1.15.0 | 1.15.0 |
Affected products
5- Range: < 1.15
- ghsa-coords3 versions
< 1.15.0+ 2 more
- (no CPE)range: < 1.15.0
- (no CPE)range: < 1.15.0
- (no CPE)range: < 1.15.0
Patches
Vulnerability mechanics
References
8- github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892nvdPatchWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2jnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-844w-j86r-4x2jghsaADVISORY
- github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.mdnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-16778ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-227.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-234.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-209.yamlghsaWEB
News mentions
0No linked articles in our index yet.