CVE-2022-41894 — HIGH (CVSS 8.1) AI Security Vulnerability

Q: Is CVE-2022-41894 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2022-41894, increasing the risk of exploitation.

Q: How to fix CVE-2022-41894?

1. PATCH: Upgrade to TensorFlow 2.11, 2.10.1, 2.9.3, or 2.8.4 (fix: commit 72c0bdcb25305b0b36842d746cc61d72658d2941). 2. WORKAROUND (if immediate patch is not possible): Block ingestion of untrusted TFLite model files at the application layer; enforce model allowlisting. 3. SUPPLY CHAIN: Implement cryptographic signing and hash verification of all TFLite models before deployment — especially in OTA/federated scenarios. 4. DETECTION: Audit TFLite version across all inference infrastructure; monitor inference processes for anomalous heap errors (SIGSEGV, SIGABRT) that may indicate exploitation attempts. 5. ARCHITECTURE: Prefer XNNPACK or GPU delegates over the reference kernel resolver in production to avoid the vulnerable code path.

Q: What systems are affected by CVE-2022-41894?

This vulnerability affects the following AI/ML architecture patterns: edge AI inference, model serving, mobile ML deployments, training pipelines.

Q: What is the CVSS score for CVE-2022-41894?

CVE-2022-41894 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.21%.

CISO Take

A crafted TFLite model can trigger a heap buffer overflow in the CONV_3D_TRANSPOSE reference kernel, potentially enabling arbitrary code execution. If your org runs TFLite inference (edge, mobile, embedded, server-side) on TF < 2.10.1/2.9.3/2.8.4/2.11, patch immediately. Critically, also audit your model supply chain — the attack requires loading a malicious model file, making model integrity verification as important as patching.

Risk Assessment

CVSS 8.1 (High) with network attack vector but high complexity. Real-world exploitability hinges on two conditions: the reference kernel resolver must be active (not the default in optimized/delegate builds), and the attacker must control or inject a TFLite model file. Organizations accepting external models — federated learning hubs, model marketplaces, edge OTA pipelines — face the highest risk. Not in CISA KEV, with no confirmed in-the-wild exploitation, but the attack primitive (malicious model file) is well within reach of capable adversaries.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed today 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

8.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC High

PR None

UI None

S Unchanged

C High

I High

A High

Recommended Action

5 steps

PATCH

Upgrade to TensorFlow 2.11, 2.10.1, 2.9.3, or 2.8.4 (fix: commit 72c0bdcb25305b0b36842d746cc61d72658d2941).
WORKAROUND (if immediate patch is not possible): Block ingestion of untrusted TFLite model files at the application layer; enforce model allowlisting.
SUPPLY CHAIN

Implement cryptographic signing and hash verification of all TFLite models before deployment — especially in OTA/federated scenarios.
DETECTION

Audit TFLite version across all inference infrastructure; monitor inference processes for anomalous heap errors (SIGSEGV, SIGABRT) that may indicate exploitation attempts.
ARCHITECTURE

Prefer XNNPACK or GPU delegates over the reference kernel resolver in production to avoid the vulnerable code path.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Supply Chain Framework Inference AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI System Design and Development

NIST AI RMF

MANAGE 2.2 - Mechanisms to Sustain Effective AI Risk Management

OWASP LLM Top 10

LLM05:2025 - Insecure Plugin Design / Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2022-41894?

A crafted TFLite model can trigger a heap buffer overflow in the CONV_3D_TRANSPOSE reference kernel, potentially enabling arbitrary code execution. If your org runs TFLite inference (edge, mobile, embedded, server-side) on TF < 2.10.1/2.9.3/2.8.4/2.11, patch immediately. Critically, also audit your model supply chain — the attack requires loading a malicious model file, making model integrity verification as important as patching.

Is CVE-2022-41894 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2022-41894, increasing the risk of exploitation.

How to fix CVE-2022-41894?

1. PATCH: Upgrade to TensorFlow 2.11, 2.10.1, 2.9.3, or 2.8.4 (fix: commit 72c0bdcb25305b0b36842d746cc61d72658d2941). 2. WORKAROUND (if immediate patch is not possible): Block ingestion of untrusted TFLite model files at the application layer; enforce model allowlisting. 3. SUPPLY CHAIN: Implement cryptographic signing and hash verification of all TFLite models before deployment — especially in OTA/federated scenarios. 4. DETECTION: Audit TFLite version across all inference infrastructure; monitor inference processes for anomalous heap errors (SIGSEGV, SIGABRT) that may indicate exploitation attempts. 5. ARCHITECTURE: Prefer XNNPACK or GPU delegates over the reference kernel resolver in production to avoid the vulnerable code path.

What systems are affected by CVE-2022-41894?

This vulnerability affects the following AI/ML architecture patterns: edge AI inference, model serving, mobile ML deployments, training pipelines.

What is the CVSS score for CVE-2022-41894?

CVE-2022-41894 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.21%.

Technical Details

NVD Description

TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result. Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels. An attacker can craft a model with a specific number of input channels. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter. We have patched the issue in GitHub commit 72c0bdcb25305b0b36842d746cc61d72658d2941. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Exploitation Scenario

An adversary targeting an organization's edge AI inference pipeline (e.g., smart camera fleet, federated learning node) crafts a TFLite model where a CONV_3D_TRANSPOSE layer has num_input_channels significantly greater than num_output_channels. The model is delivered via a compromised model update server or malicious model upload to a training/serving platform. When the TFLite runtime loads and executes the model with the reference kernel resolver active, the bias loop overwrites heap memory beyond the output buffer. Since bias values are attacker-controlled, this enables targeted corruption of adjacent heap structures — function pointers, vtables — potentially yielding code execution on edge devices where patching cadence is slow.