# CVE-2022-23584: PYSEC-2026-3085 - Use after free in `DecodePng` kernel

Source: https://junglewise.ai/threats/cve-2022-23584-tensorflow-decodepng-use-after-free-in-png-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-23584 · Severity: low · CVSS 3.1 · Published 2026-07-09

TensorFlow is a widely-used machine learning library that processes image data as part of its core functionality. A flaw in the PNG image decoding component can cause a program crash or potential data corruption when processing specially crafted PNG files, affecting systems that rely on TensorFlow for image processing tasks.

Technologies: [Google TensorFlow](https://junglewise.ai/threats/technologies/tensorflow), [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow), [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu), [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-23584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-23584 being exploited in the wild.

**How severe is CVE-2022-23584?** Low severity, with a CVSS score of 3.1, published 9 July 2026.

**Which products and versions are affected?** Google TensorFlow before 2.5.3; 2.6.0-2.6.2; 2.7.0; tensorflow (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3,introduced=2.7.0,fixed=2.7.1; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=e746adbfcfee15e9cfdb391ff746c765b99bdf9b|ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3; tensorflow-gpu (PyPI) GIT:introduced=0,fixed=e746adbfcfee15e9cfdb391ff746c765b99bdf9b|ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3.

**Is there a fix for CVE-2022-23584?** Yes. tensorflow (PyPI): upgrade to 2.7.1 or later; tensorflow-cpu (PyPI): upgrade to 2.6.3 or later; tensorflow-gpu (PyPI): upgrade to 2.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-23584 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-23584?** Check whether you run Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tensorflow (PyPI): upgrade to 2.7.1 or later

  ```sh
  pip install "tensorflow>=2.7.1"
  ```

- tensorflow-cpu (PyPI): upgrade to 2.6.3 or later

  ```sh
  pip install "tensorflow-cpu>=2.6.3"
  ```

- tensorflow-gpu (PyPI): upgrade to 2.6.3 or later

  ```sh
  pip install "tensorflow-gpu>=2.6.3"
  ```


## Technical details

A use-after-free vulnerability exists in the DecodePng kernel's error handling path. When decoding PNG images, if certain error conditions are met (e.g., PNG dimensions exceed integer limits), the code calls png::CommonFreeDecode() to clean up resources, but then attempts to read from freed memory (decode.width and decode.height) in the error message construction. The vulnerability is reachable via PNG image processing without authentication and can be triggered by malicious PNG input. The fix involves moving error checking before resource allocation to prevent the use-after-free. Patches are available in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0.

## Affected products

- Google TensorFlow before 2.5.3; 2.6.0-2.6.2; 2.7.0
- Google TensorFlow CPU before 2.5.3; 2.6.0-2.6.2; 2.7.0
- Google TensorFlow GPU before 2.5.3; 2.6.0-2.6.2; 2.7.0

## Identifiers

- CVE-2022-23584
- GHSA-24x4-6qmh-88qg
- PYSEC-2022-148
- PYSEC-2022-93
- PYSEC-2026-3085

## Timeline

- 2022-02-04: disclosed: Vulnerability advisory published
- 2022-02-09: patched: Patches released in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0

## References

- [https://github.com/tensorflow/tensorflow/security/advisories/GHSA-24x4-6qmh-88qg](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-24x4-6qmh-88qg)

## Related threats

- [PYSEC-2026-3331 - TensorFlow has segfault in array_ops.upper_bound](https://junglewise.ai/threats/cve-2023-33976-tensorflow-has-segfault-in-array-ops-upper-bound)
- [PYSEC-2026-3182 - TensorFlow Denial of Service vulnerability](https://junglewise.ai/threats/cve-2023-25661-tensorflow-denial-of-service-vulnerability)
- [PYSEC-2026-3300 - TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch](https://junglewise.ai/threats/cve-2023-25659-tensorflow-vulnerable-to-out-of-bounds-read-in-dynamicstitch)
- [PYSEC-2026-3362 - TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`](https://junglewise.ai/threats/cve-2023-25660-tensorflow-vulnerable-to-seg-fault-in-tf-raw-ops-print)
- [PYSEC-2026-3293 - TensorFlow vulnerable to integer overflow in EditDistance](https://junglewise.ai/threats/cve-2023-25662-tensorflow-vulnerable-to-integer-overflow-in-editdistance)