AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TensorFlowGHSA-gf97-q72m-7579

TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

TensorFlow

CVE-2023-25674 · Published Mar 24, 2023 · updated Jul 13, 2026

High7.5
Fix: upgrade to 2.11.1 or later
GitHub advisory

Impact

NPE in RandomShuffle with XLA enable

```python

import tensorflow as tf

func = tf.raw_ops.RandomShuffle

para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}

@tf.function(jit_compile=True)

def test():

y = func(**para)

return y

test()

`

Patches

We have patched the issue in GitHub commit [728113a3be690facad6ce436660a0bc1858017fa](https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

Affected versions

PackageAffectedFixed in
tensorflow
PyPI
< 2.11.12.11.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-476
Also known as
BIT-tensorflow-2023-25674, CVE-2023-25674, PYSEC-2026-3189, PYSEC-2026-3330, PYSEC-2026-999

More TensorFlow advisories

All TensorFlow