CVE-2021-37682

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200). The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different that `kTfLiteNoQuantization`. However, these checks are missing in large parts of the code. We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-376835.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is [vulCVE-2021-376845.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulCVE-2021-376855.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`expand_dims.cc`](https://github.com/tCVE-2021-376865.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has aCVE-2021-376875.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`GatherNd` implementation](https://gitCVE-2021-376885.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would CVE-2021-376895.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would CVE-2021-37699.8# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied stCVE-2021-376906.6TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (suCVE-2021-376915.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would CVE-2021-376925.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a CVE-2021-376937.5Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional em
CVE-2021-37682: High severity, CVSS 7.1 | Vulnix