# CVE-2021-29590: TensorFlow TFLite heap out-of-bounds read in Minimum or Maximum

Source: https://junglewise.ai/threats/cve-2021-29590-tensorflow-tflite-heap-out-of-bounds-read-in-minimum-or-maximum  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2021-29590 · Severity: low · CVSS 3.1 · Published 2021-05-14

TensorFlow Lite is a machine learning inference engine used to run neural network models on mobile and embedded devices. A flaw in the Minimum and Maximum operators allows an attacker to read data from outside the bounds of allocated memory when processing empty input tensors, potentially exposing sensitive information from adjacent memory regions.

Technologies: [Google TensorFlow](https://junglewise.ai/threats/technologies/tensorflow), [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow), [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu), [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-29590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-29590 being exploited in the wild.

**How severe is CVE-2021-29590?** Low severity, with a CVSS score of 3.1, published 14 May 2021.

**Which products and versions are affected?** Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1; Google TensorFlow Lite before 2.5.0; tensorflow (PyPI) GIT:introduced=0,fixed=953f28dca13c92839ba389c055587cfe6c723578|ECOSYSTEM:introduced=0,fixed=2.1.4,introduced=2.2.0,fixed=2.2.3,introduced=2.3.0,fixed=2.3.3,introduced=2.4.0,fixed=2.4.2; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=953f28dca13c92839ba389c055587cfe6c723578|ECOSYSTEM:introduced=0,fixed=2.1.4,introduced=2.2.0,fixed=2.2.3,introduced=2.3.0,fixed=2.3.3,introduced=2.4.0,fixed=2.4.2; and 1 more.

**Is there a fix for CVE-2021-29590?** Yes. tensorflow (PyPI): upgrade to 2.4.2 or later; tensorflow-cpu (PyPI): upgrade to 2.4.2 or later; tensorflow-gpu (PyPI): upgrade to 2.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-29590 attacked?** It is attacked with local access.

**Am I affected by CVE-2021-29590?** Check whether you run Google TensorFlow, Google TensorFlow Lite, tensorflow (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tensorflow (PyPI): upgrade to 2.4.2 or later

  ```sh
  pip install "tensorflow>=2.4.2"
  ```

- tensorflow-cpu (PyPI): upgrade to 2.4.2 or later

  ```sh
  pip install "tensorflow-cpu>=2.4.2"
  ```

- tensorflow-gpu (PyPI): upgrade to 2.4.2 or later

  ```sh
  pip install "tensorflow-gpu>=2.4.2"
  ```


## Technical details

A heap out-of-bounds (OOB) read vulnerability exists in TensorFlow Lite's broadcasting implementation for the Minimum and Maximum operators (CWE-125). The vulnerability occurs when either of the two input tensors is empty; the broadcasting logic uses the same index to read from both input tensors without validating that the index is within bounds. An attacker can craft a model with empty tensor inputs to trigger an out-of-bounds memory read. No authentication or network access is required—only the ability to provide a malicious model to the inference engine. The vulnerability has been patched in TensorFlow 2.5.0, with backports to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

## Affected products

- Google TensorFlow 0.12.0 through 2.1.3, 2.2.0 through 2.2.2, 2.3.0 through 2.3.2, 2.4.0 through 2.4.1
- Google TensorFlow Lite before 2.5.0

## Identifiers

- CVE-2021-29590
- GHSA-24x6-8c7m-hv3f
- PYSEC-2021-227
- PYSEC-2021-518
- PYSEC-2021-716

## Timeline

- 2021-05-13: disclosed
- 2021-05-21: advisory
- 2021-05-21: patched: Patches released in TensorFlow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0

## References

- [https://github.com/tensorflow/tensorflow/security/advisories/GHSA-24x6-8c7m-hv3f](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-24x6-8c7m-hv3f)

## Related threats

- [PYSEC-2026-3331 - TensorFlow has segfault in array_ops.upper_bound](https://junglewise.ai/threats/cve-2023-33976-tensorflow-has-segfault-in-array-ops-upper-bound)
- [PYSEC-2026-3182 - TensorFlow Denial of Service vulnerability](https://junglewise.ai/threats/cve-2023-25661-tensorflow-denial-of-service-vulnerability)
- [PYSEC-2026-3300 - TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch](https://junglewise.ai/threats/cve-2023-25659-tensorflow-vulnerable-to-out-of-bounds-read-in-dynamicstitch)
- [PYSEC-2026-3362 - TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`](https://junglewise.ai/threats/cve-2023-25660-tensorflow-vulnerable-to-seg-fault-in-tf-raw-ops-print)
- [PYSEC-2026-3293 - TensorFlow vulnerable to integer overflow in EditDistance](https://junglewise.ai/threats/cve-2023-25662-tensorflow-vulnerable-to-integer-overflow-in-editdistance)