Medium
Security advisory
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15209
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:38 UTC · Revision 1
Source evidence
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
osv:CVE-2020-15209
Complete source record
{
"id": "6e0b3111a955b87d0ff409e53c192b8d660a1c3913d3ca3781fb7cfe283fa747",
"url": "https://osv.dev/vulnerability/CVE-2020-15209",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15209",
"summary": "In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.",
"evidence": "osv:CVE-2020-15209",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-15209",
"aliases": [
"BIT-tensorflow-2020-15209",
"CVE-2020-15209",
"GHSA-qh32-6jjc-qprm",
"PYSEC-2020-132",
"PYSEC-2020-289",
"PYSEC-2020-324"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tensorflow/tensorflow",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "df8c55ce12b5cfc6f29b01889f7773911a75e6ef"
},
{
"introduced": "64c3d382cadf7bbe8e7e99884bede8284ff67f56"
},
{
"fixed": "295ad2781683835be974faba0a191528d8079768"
},
{
"introduced": "e5bf8de410005de06a7ff5393fafdf832ef1d4ad"
},
{
"fixed": "ab35f2bf7132f9d20a0bea9a5d1849862737d4b4"
},
{
"introduced": "2b96f3662bd776e277f86997659e61046b56c315"
},
{
"fixed": "25fba035f3e453d94490932096282c7b0624bbb3"
},
{
"introduced": "b36436b087bd8e8701ef51718179037cccdfc26e"
},
{
"fixed": "fcc4b966f1265f466e82617020af93670141b009"
},
{
"fixed": "0b5662bc2be13a8c8f044d925d87fb6e56247cd8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.15.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "0b5662bc2be13a8c8f044d925d87fb6e56247cd8"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "fcc4b966f1265f466e82617020af93670141b009"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.3.1"
}
]
}
}
],
"versions": [
"v2.2.0",
"v2.1.1",
"v2.3.0",
"v2.0.2",
"v1.15.3",
"v2.0.1",
"v2.1.0",
"v1.15.2",
"v1.15.0",
"v1.15.0-rc3",
"v2.0.0",
"v1.15.0-rc2",
"v1.15.0-rc1",
"v1.15.0-rc0",
"v1.12.1",
"v1.9.0-rc2",
"v1.6.0-rc1",
"v1.1.0-rc2",
"v1.1.0-rc1",
"0.6.0",
"0.5.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15209.json",
"vanir_signatures": [
{
"id": "CVE-2020-15209-1c08137f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"118310501331616023350717681784829709784",
"57364967679429806816256655767148470264",
"102921009719167603431635488173237461403",
"53810865977217055415276430758078361965",
"305638738759426742636057687230277032594",
"34872329951284026900110491077515923900",
"202202117899958313685333926239881024739",
"157562451449126841672195308694127197625",
"149073477471276229723057206179610917054",
"274105956972391255319063024138059560180",
"230596824339254107197600048256212159624",
"309207681048257396052300636804196043320",
"65600312656929052008905661471385857207",
"144945867077828154796586203507136244400",
"124552705122710412742356347640769760909",
"131598364421439620296301899740248428117",
"189004029897638777771318898477545259908",
"84070706133558568929049029694655438503"
]
},
"source": "https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8",
"target": {
"file": "tensorflow/lite/model_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15209-432c9fb2",
"digest": {
"length": 2213,
"function_hash": "66171894964802191235365235219766751684"
},
"source": "https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8",
"target": {
"file": "tensorflow/lite/core/subgraph.cc",
"function": "Subgraph::Invoke"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15209-54e67227",
"digest": {
"threshold": 0.9,
"line_hashes": [
"288632793624738279975311723889403186854",
"231838817353400695959687593382318508022",
"136835989989611429058744611617542146033",
"319476659976459967670411920219287419521",
"259493130716973356554453251726916005105",
"55895977300738371728966476833896950516",
"80620433833618409211919915782517539096",
"82089039147305956708211307876170608615"
]
},
"source": "https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8",
"target": {
"file": "tensorflow/lite/core/subgraph.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15209-94238736",
"digest": {
"length": 474,
"function_hash": "72409903535934688868846486751425969565"
},
"source": "https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8",
"target": {
"file": "tensorflow/lite/model_test.cc",
"function": "TEST"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:10:27Z"
}
}
],
"modified": "2026-10-20T14:10:27.561598308Z",
"provider": "osv",
"references": [
"https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1",
"https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8",
"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qh32-6jjc-qprm"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.2"
},
{
"last_affected": "15.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-15209",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388610,
"published_at": "2020-09-25T19:15:16.213+00:00"
}