CVE-2026-65918

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65918
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65918.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65918
Downstream
Published
2026-07-23T17:36:42Z
Modified
2026-08-24T03:59:16Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PyTorch torchvision GIF Decoder Out-of-bounds Heap Read
Details

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65918.json"
}
References

Affected packages

Git / github.com/pytorch/vision

Affected ranges

Type
GIT
Repo
https://github.com/pytorch/vision
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:linuxfoundation:torchvision:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.28.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
tag_from_my_fork
v0.*
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.2.1
v0.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65918.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "112132269515122070679201174750253132581",
            "length": 2687
        },
        "id": "CVE-2026-65918-102aff36",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed",
        "target": {
            "file": "torchvision/csrc/io/image/cpu/decode_gif.cpp",
            "function": "decode_gif"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "280455404921887885591313047448875450975",
            "length": 348
        },
        "id": "CVE-2026-65918-12665c40",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed",
        "target": {
            "file": "torchvision/csrc/io/image/cpu/decode_gif.cpp",
            "function": "read_from_tensor"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "287116950136699001826328110265274045585",
                "241599930362376094676090232212194005682",
                "51171007898239082412509034563661975000",
                "279270508737142767250940464214616372129",
                "262815012768025303260000722582759609967",
                "26689528985233545659473290888660546493",
                "15320229776471154267630209268125280188",
                "126775920781419179365776900723565513340",
                "32939749411153876891360162533780043152",
                "34347866392657203696073342677444758757",
                "120694394138037033245195067498717988613",
                "150057024942589753093511323552547581327",
                "86036999864605961883853931719903130984",
                "184862781279256192962279724132253258026",
                "319121864654706858116227764488291508619",
                "141173664417298701392455715551165710818",
                "63926407033617162061508760228572892092"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65918-918f85af",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed",
        "target": {
            "file": "torchvision/csrc/io/image/cpu/decode_gif.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-08-24T03:59:16Z"