Critical severity9.8NVD Advisory· Published Mar 25, 2023· Updated Jun 17, 2026

CVE-2023-25668

Description

TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
tensorflowPyPI	< 2.11.1	2.11.1
tensorflow-cpuPyPI	< 2.11.1	2.11.1
tensorflow-gpuPyPI	< 2.11.1	2.11.1

Affected products

Google/Tensorflow
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Range: <2.12.0
osv-coords4 versions
pkg:bitnami/tensorflow pkg:pypi/tensorflow pkg:pypi/tensorflow-cpu pkg:pypi/tensorflow-gpu
< 2.12.0+ 3 more
- (no CPE)range: < 2.12.0
- (no CPE)range: < 2.11.1
- (no CPE)range: < 2.11.1
- (no CPE)range: < 2.11.1
Nbsdx/Tensorflowv5
Range: < 2.11.1

Patches

Vulnerability mechanics

References

github.com/tensorflow/tensorflow/security/advisories/GHSA-gw97-ff7c-9v96nvdPatchWEB
github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccbnvdExploitPatchWEB
github.com/advisories/GHSA-gw97-ff7c-9v96ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-25668ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000