High
Security advisory
In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-26267
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:39 UTC · Revision 1
Source evidence
In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
osv:CVE-2020-26267
Complete source record
{
"id": "fd04b6b474bd3aa8d9ddaf551413a42874baf6b7b9ee4b926202bd2c6a19c98e",
"url": "https://osv.dev/vulnerability/CVE-2020-26267",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-26267",
"summary": "In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
"evidence": "osv:CVE-2020-26267",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-26267",
"aliases": [
"BIT-tensorflow-2020-26267",
"CVE-2020-26267",
"GHSA-c9f3-9wfr-wgh7",
"PYSEC-2020-140",
"PYSEC-2020-298",
"PYSEC-2020-333"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tensorflow/tensorflow",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3db52be7be81a87c623cdeb7f03d3767521c5246"
},
{
"introduced": "64c3d382cadf7bbe8e7e99884bede8284ff67f56"
},
{
"fixed": "cdf2c541c3dd3fb6d03cce4d23fc6c548bc9017c"
},
{
"introduced": "e5bf8de410005de06a7ff5393fafdf832ef1d4ad"
},
{
"fixed": "77f47d6ed6ca1f50b6f2c4919097e625d50398a9"
},
{
"introduced": "2b96f3662bd776e277f86997659e61046b56c315"
},
{
"fixed": "d745ff2a48cebf18e847e8b602a744e97e058946"
},
{
"introduced": "b36436b087bd8e8701ef51718179037cccdfc26e"
},
{
"fixed": "9edbe5075f79a4a95ed14a2be831f9b59e61f49d"
},
{
"fixed": "ebc70b7a592420d3d2f359e4b1694c236b82c7ae"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.15.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "ebc70b7a592420d3d2f359e4b1694c236b82c7ae"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.1.2",
"v2.0.3",
"v1.15.4",
"v2.2.1",
"v2.3.1",
"v2.2.0",
"v2.1.1",
"v2.3.0",
"v2.0.2",
"v1.15.3",
"v2.0.1",
"v2.1.0",
"v1.15.2",
"v1.15.0",
"v1.15.0-rc3",
"v2.0.0",
"v1.15.0-rc2",
"v1.15.0-rc1",
"v1.15.0-rc0",
"v1.12.1",
"v1.9.0-rc2",
"v1.6.0-rc1",
"v1.1.0-rc2",
"v1.1.0-rc1",
"0.6.0",
"0.5.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26267.json",
"vanir_signatures": [
{
"id": "CVE-2020-26267-8190db3f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313994650402161586983917689434894485802",
"130094773882623805663869682974364817317",
"63662868083627739254062862644034061447",
"275359223353134641114808102223859573201",
"331307440669214918335895790650776587077",
"83951950775522996153541642463375565806",
"110680478284734640215047087273084300657",
"329825087871365426555773122036027749837",
"222270992452315474643495052266487055826",
"315158931149083809491559055218996155829",
"154603388818363930582659611870291908667",
"185512401193860114234021105676990606824",
"183029446372740524683017777512646302102",
"1168723795512549235036915952055206157",
"266922330232993059882635503985676463356",
"133513391166850736861106802961685794558",
"235945220321055799821111067271733113331",
"251561166443076125767835700795166849206",
"65525740044841502909301842366178829085",
"148869675187540353363397726555020981607",
"332263761514826419796309180666719486048",
"53259635203583304156903165929834843192",
"186953506709105487264072941382648011490",
"79885697303505286815583400913045160495",
"221193189215687644294057407398960998497",
"121242689760206006999865113691868911763",
"252420941107585766993710310642148456276",
"142575214691111786979361361394672029840",
"179634542567091506405428502619255654047",
"157462980713806617184162930771827281434"
]
},
"source": "https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae",
"target": {
"file": "tensorflow/core/kernels/data_format_ops.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:10:49Z"
}
}
],
"modified": "2026-10-20T14:10:49.191438613Z",
"provider": "osv",
"references": [
"https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae",
"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr-wgh7"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-26267",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388661,
"published_at": "2020-12-10T23:15:12.723+00:00"
}