PT-2026-64043 · Pytorch · Vision

George Chen · CVE-2026-65918 · Published 2026-07-23 · Updated 2026-07-23

Mitre

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read from tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-65918

Affected Products

Vision

References · 5

• 🔥 https://github.com/pytorch/vision/issues/9551 · Exploit
• https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65918 · Security Note
• https://github.com/pytorch/vision/pull/9520 · Note
• https://vulncheck.com/advisories/pytorch-torchvision-gif-decoder-out-of-bounds-heap-read · Note