CVE-2021-41227

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412287.8TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code CVE-2021-412296.5BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory wh CVE-2021-41236.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-412308.8Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are no CVE-2021-412317.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via Dat CVE-2021-412329.8Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection CVE-2021-412335.3Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text ap CVE-2021-412364.8OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to em CVE-2021-412387.5Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate p CVE-2021-412395.3Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider CVE-2021-41246.1janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-412414.3Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing