-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing input validation in BaseCandidateSamplerOp's Compute method. The commit diff shows validation was added in candidate_sampler_ops.cc where true_classes values are checked against the sampler's range. The vulnerable versions lacked this check, allowing values ≥ range_max to trigger heap OOB reads during candidate processing. The function is directly referenced in vulnerability descriptions and the patch targets this specific location.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-cpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-gpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow | pip | < 2.8.4 | 2.8.4 |
| tensorflow-cpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow-gpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
A Semantic Attack on Google Gemini - Read the Latest Research