# CVE-2021-41226: TensorFlow heap buffer overflow in SparseBinCount

Source: https://junglewise.ai/threats/cve-2021-41226-tensorflow-heap-buffer-overflow-in-sparsebincount  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2021-41226 · Severity: low · CVSS 3.1 · Published 2021-11-05

TensorFlow is an open-source machine learning framework widely used for building and training AI models. The SparseBinCount operation in TensorFlow contains a heap buffer overflow vulnerability caused by missing input validation. An attacker with the ability to invoke this operation with maliciously crafted arguments could read or write to memory outside intended bounds, potentially leading to information disclosure or denial of service.

Technologies: [Google TensorFlow](https://junglewise.ai/threats/technologies/tensorflow), [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow), [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu), [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-41226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-41226 being exploited in the wild.

**How severe is CVE-2021-41226?** Low severity, with a CVSS score of 3.1, published 5 November 2021.

**Which products and versions are affected?** Google TensorFlow before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1, 2.7.0; tensorflow (PyPI) GIT:introduced=0,fixed=f410212e373eb2aec4c9e60bf3702eba99a38aba|ECOSYSTEM:introduced=0,fixed=2.4.4,introduced=2.5.0,fixed=2.5.2,introduced=2.6.0,fixed=2.6.1,introduced=2.7.0rc0,fixed=2.7.0; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=f410212e373eb2aec4c9e60bf3702eba99a38aba|ECOSYSTEM:introduced=0,fixed=2.4.4,introduced=2.5.0,fixed=2.5.2,introduced=2.6.0,fixed=2.6.1,introduced=2.7.0rc0,fixed=2.7.0; tensorflow-gpu (PyPI) GIT:introduced=0,fixed=f410212e373eb2aec4c9e60bf3702eba99a38aba|ECOSYSTEM:introduced=0,fixed=2.4.4,introduced=2.5.0,fixed=2.5.2,introduced=2.6.0,fixed=2.6.1,introduced=2.7.0rc0,fixed=2.7.0.

**Is there a fix for CVE-2021-41226?** Yes. tensorflow (PyPI): upgrade to 2.7.0 or later; tensorflow-cpu (PyPI): upgrade to 2.7.0 or later; tensorflow-gpu (PyPI): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-41226 attacked?** It is attacked with local access.

**Am I affected by CVE-2021-41226?** Check whether you run Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tensorflow (PyPI): upgrade to 2.7.0 or later

  ```sh
  pip install "tensorflow>=2.7.0"
  ```

- tensorflow-cpu (PyPI): upgrade to 2.7.0 or later

  ```sh
  pip install "tensorflow-cpu>=2.7.0"
  ```

- tensorflow-gpu (PyPI): upgrade to 2.7.0 or later

  ```sh
  pip install "tensorflow-gpu>=2.7.0"
  ```


## Technical details

The vulnerability is a heap out-of-bounds (OOB) access in the SparseBinCount operation due to missing validation between the elements of the `values` argument and the shape of the sparse output tensor. When the operation processes sparse tensor indices, it directly uses unchecked values as bin indices without verifying they are within the allocated tensor bounds. This allows an attacker to craft sparse tensor inputs where the `values` parameter contains indices larger than the output tensor dimensions, causing writes or reads beyond allocated heap memory. The vulnerability affects TensorFlow versions prior to 2.7.0, with patches available for 2.4.4, 2.5.2, and 2.6.1.

## Affected products

- Google TensorFlow before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1, 2.7.0
- Google TensorFlow CPU before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1
- Google TensorFlow GPU before 2.7.0; patched in 2.4.4, 2.5.2, 2.6.1

## Identifiers

- CVE-2021-41226
- GHSA-374m-jm66-3vj8
- PYSEC-2021-418
- PYSEC-2021-635
- PYSEC-2021-833

## Timeline

- 2021-11-04: disclosed
- 2021-11-10: patched: Fix included in TensorFlow 2.7.0 and backported to 2.6.1, 2.5.2, 2.4.4

## References

- [https://github.com/tensorflow/tensorflow/security/advisories/GHSA-374m-jm66-3vj8](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-374m-jm66-3vj8)

## Related threats

- [PYSEC-2026-3331 - TensorFlow has segfault in array_ops.upper_bound](https://junglewise.ai/threats/cve-2023-33976-tensorflow-has-segfault-in-array-ops-upper-bound)
- [PYSEC-2026-3182 - TensorFlow Denial of Service vulnerability](https://junglewise.ai/threats/cve-2023-25661-tensorflow-denial-of-service-vulnerability)
- [PYSEC-2026-3300 - TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch](https://junglewise.ai/threats/cve-2023-25659-tensorflow-vulnerable-to-out-of-bounds-read-in-dynamicstitch)
- [PYSEC-2026-3362 - TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`](https://junglewise.ai/threats/cve-2023-25660-tensorflow-vulnerable-to-seg-fault-in-tf-raw-ops-print)
- [PYSEC-2026-3293 - TensorFlow vulnerable to integer overflow in EditDistance](https://junglewise.ai/threats/cve-2023-25662-tensorflow-vulnerable-to-integer-overflow-in-editdistance)