p PatchFirst

CVE-2026-65918

CVE-2026-65918 · PyTorch torchvision GIF Decoder Out-of-bounds Heap Read

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

CVSS 7.1 · High · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • vision

    Versions
    • ≥ 0, ≤ 0.28.0: Affected (semver)
    • 4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed: Not affected (git)

    No fix published

  • pytorch-vision Debian:12

    Versions
    • 0.14.1-2
    • 0.15.2-1
    • 0.19.1-1
    • 0.20.1-1
    • 0.21.0-1
    • 0.21.0-2
    • 0.21.0-3
    • 0.24.1-1
    • 0.27.0-1
    • 0.27.0-1~exp1
    • 0.27.0-2
    • 0.27.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch-vision Debian:13

    Versions
    • 0.21.0-3
    • 0.24.1-1
    • 0.27.0-1
    • 0.27.0-1~exp1
    • 0.27.0-2
    • 0.27.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch-vision Debian:14

    Versions
    • 0.21.0-3
    • 0.24.1-1
    • 0.27.0-1
    • 0.27.0-1~exp1
    • 0.27.0-2
    • 0.27.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch Ubuntu:22.04:LTS

    Versions
    • 1.7.1-7
    • 1.8.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch-vision Ubuntu:22.04:LTS

    Versions
    • 0.8.2-1
    • 0.8.2-1ubuntu1
    • 0.8.2-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch Ubuntu:26.10

    Versions
    • 2.9.1+dfsg-1~exp1ubuntu2
    • 2.12.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch-vision Ubuntu:26.10

    Versions
    • 0.27.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pytorch Ubuntu:26.04:LTS

    Versions
    • 2.6.0+dfsg-7
    • 2.6.0+dfsg-9
    • 2.9.1+dfsg-1~exp1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →