CVE-2026-65918CWE-125

CVE-2026-65918

High · published July 23, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-07-23T22:17Z
Affected products (1)
ProductVersionsFixed in
linuxfoundation/torchvision≤ 0.28.0—
References (4)
https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed · [email protected]https://github.com/pytorch/vision/issues/9551 · [email protected]https://github.com/pytorch/vision/pull/9520 · [email protected]https://www.vulncheck.com/advisories/pytorch-torchvision-gif-decoder-out-of-bounds-heap-read · [email protected]
EPSS history
Timeline
  • 23 JUL 17:36Z
    PyTorch torchvision GIF Decoder Out-of-bounds Heap Read
    cvelistv5