Vulnerability Details : CVE-2020-26266

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Published 2020-12-10 23:15:13
Updated 2020-12-14 17:54:10
Source GitHub, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-26266

Probability of exploitation activity in the next 30 days: 0.09%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 37 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-26266

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
4.6
 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P
3.9
6.4
 nvd@nist.gov
5.3
 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1.8
3.4
 nvd@nist.gov
4.4
 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
1.8
2.5
 security-advisories@github.com

CWE ids for CVE-2020-26266

  • The product uses or accesses a resource that has not been initialized.
    Assigned by:
    • nvd@nist.gov (Primary)
    • security-advisories@github.com (Secondary)

References for CVE-2020-26266

Products affected by CVE-2020-26266

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close