CVE-2026-65918: PyTorch torchvision GIF Decoder Out-of-bounds Heap Read
PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyTorch torchvisionto a version that resolves this vulnerability.Fixed in 0.28.0Patch 4e05dc2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65918?
CVE-2026-65918 has a high severity rating of 7.1.
How do I fix CVE-2026-65918?
To fix CVE-2026-65918, update PyTorch torchvision to the latest version after commit 4e05dc2.
What type of vulnerability is CVE-2026-65918?
CVE-2026-65918 is an out-of-bounds heap read vulnerability in the GIF decoder of PyTorch torchvision.
What are the potential impacts of CVE-2026-65918?
CVE-2026-65918 can lead to denial of service via segmentation faults when malicious or truncated GIF files are processed.
Which versions of PyTorch torchvision are affected by CVE-2026-65918?
CVE-2026-65918 affects PyTorch torchvision through version 0.28.0.