TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the TensorFlow HDF5 library. This issue arises from the application loading plugins from an unsecured location, allowing attackers with low-privileged code execution capabilities to escalate privileges and execute arbitrary code in the context of the affected user. The vulnerability was reported to the vendor on March 11, 2025.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to execute code with elevated rights.

Remediation

TensorFlow has released a patch for this vulnerability. Users should update to the latest version of TensorFlow. Instructions for updating can be found in the TensorFlow documentation.