CVE-2022-41895: TensorFlow heap OOB — HIGH

CISO Take

Any TensorFlow deployment exposing image processing or gradient computation to untrusted input is at risk of unauthenticated remote crash. The attack requires no privileges and no user interaction — a single malformed request can take down an inference or training service. Patch to TF 2.11, 2.10.1, 2.9.3, or 2.8.4 immediately; if patching is delayed, add input validation and rate-limiting on all TF serving endpoints.

What is the risk?

High severity (CVSS 7.5) with a narrow but real blast radius. The availability-only impact (C:N/I:N/A:H) limits business risk to service disruption rather than data breach. However, the AV:N/AC:L/PR:N/UI:N vector means any internet-exposed TensorFlow Serving instance is exploitable by script-kiddies. Risk elevates significantly for production ML inference APIs handling image-related tasks, as a DoS attack could blind downstream detection or classification systems that security tooling depends on.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
195.8K OpenSSF 7.1 3.7K dependents Pushed 3d ago 4% patched ~1372d to patch Full package profile →

Do you use TensorFlow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

6 steps

Patch: Upgrade to TensorFlow 2.11, 2.10.1, 2.9.3, or 2.8.4 (commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92).
Input validation: Enforce strict bounds on paddings tensor dimensions at the API gateway or application layer before passing to TF ops.
Process isolation: Run TF serving in sandboxed containers with memory limits so a crash does not cascade.
Rate limiting: Apply per-client rate limits on inference endpoints to reduce DoS amplification.
Detection: Monitor for TF process crashes or OOM-killer events; alert on abnormal tensor size inputs in request logs.
Inventory: Identify all internal services linking TF image processing ops to externally controlled input.

How is it classified?

DoS Framework Inference AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity of high-risk AI systems

ISO 42001

A.6.2.6 - Security of AI system components A.9.2 - Availability of AI systems

NIST AI RMF

GOVERN 4.2 - Organizational policies for AI risk MANAGE 2.2 - Mechanisms to achieve AI risk management objectives

Frequently Asked Questions

What is CVE-2022-41895?

Any TensorFlow deployment exposing image processing or gradient computation to untrusted input is at risk of unauthenticated remote crash. The attack requires no privileges and no user interaction — a single malformed request can take down an inference or training service. Patch to TF 2.11, 2.10.1, 2.9.3, or 2.8.4 immediately; if patching is delayed, add input validation and rate-limiting on all TF serving endpoints.

Is CVE-2022-41895 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2022-41895, increasing the risk of exploitation.

How to fix CVE-2022-41895?

1. Patch: Upgrade to TensorFlow 2.11, 2.10.1, 2.9.3, or 2.8.4 (commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92). 2. Input validation: Enforce strict bounds on paddings tensor dimensions at the API gateway or application layer before passing to TF ops. 3. Process isolation: Run TF serving in sandboxed containers with memory limits so a crash does not cascade. 4. Rate limiting: Apply per-client rate limits on inference endpoints to reduce DoS amplification. 5. Detection: Monitor for TF process crashes or OOM-killer events; alert on abnormal tensor size inputs in request logs. 6. Inventory: Identify all internal services linking TF image processing ops to externally controlled input.

What systems are affected by CVE-2022-41895?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, inference endpoints, image processing pipelines.

What is the CVSS score for CVE-2022-41895?

CVE-2022-41895 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesinference endpointsimage processing pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6, A.9.2

NIST AI RMF: GOVERN 4.2, MANAGE 2.2

What are the technical details?

Original Advisory

TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Exploitation Scenario

An adversary targeting a computer vision API (e.g., a fraud detection image classifier or an AI-powered content moderation service) crafts a POST request with an oversized paddings tensor to the TF Serving gRPC or REST endpoint. The MirrorPadGrad kernel reads beyond allocated heap memory, triggering a process crash. The attacker repeats this at intervals to maintain a persistent DoS against the inference service, effectively blinding any downstream security or operational system that depends on real-time image classification. No ML knowledge is required — only knowledge that the target uses TensorFlow and processes padded image tensors.

Weaknesses (CWE)

CWE-125 Out-of-bounds Read

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.