-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.11.1 | 2.11.1 |
| tensorflow-cpu | pip | < 2.11.1 | 2.11.1 |
| tensorflow-gpu | pip | < 2.11.1 | 2.11.1 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from an integer overflow in buffer size calculation during GIF decoding. The commit diff shows the critical fix was changing 'int buffer_size' to 'ptrdiff_t buffer_size' and casting num_frames to ptrdiff_t in the multiplication. This lambda function in DecodeImageV2Op's Compute method directly handles the vulnerable calculation. The loop variables in gif_io.cc were also patched, but the primary vulnerability resides in the buffer size computation logic exposed by the reproducer involving large frame dimensions.
Ongoing coverage of React2Shell