CVE-2026-65918 in torchvision
Summary
by MITRE • 07/23/2026
PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability under discussion represents a critical out-of-bounds heap read flaw discovered in PyTorch torchvision library versions prior to 0.28.0, specifically within the GIF decoder component. This issue manifests through the read_from_tensor callback function which fails to properly clamp or validate input parameters before performing memory operations. The flaw exists at the intersection of memory safety and image processing validation, creating a pathway for malicious input to trigger unintended memory access patterns.
The technical implementation of this vulnerability stems from improper bounds checking within the GIF decoding logic where the length parameter derived from parsed GIF metadata is directly passed to memcpy without adequate clamping or validation. This allows attackers to craft specially malformed GIF files that contain oversized or invalid length values, causing the decoder to attempt reading beyond the allocated heap buffer boundaries. The vulnerability operates at the level of heap memory management and demonstrates a classic pattern of insufficient input validation leading to memory corruption.
From an operational perspective, this vulnerability creates significant risk for systems processing untrusted image data through PyTorch torchvision components. Attackers can exploit this flaw by providing malicious GIF files that trigger segmentation faults during decoding or potentially expose adjacent heap memory contents through the out-of-bounds read behavior. The denial of service aspect prevents legitimate image processing operations while the information disclosure component could reveal sensitive data from memory regions adjacent to the vulnerable buffer, making this a particularly dangerous vulnerability in environments handling diverse untrusted inputs.
The security implications align with CWE-129 which addresses improper validation of length parameters and CWE-787 which covers out-of-bounds write vulnerabilities that often manifest similarly in memory safety contexts. This vulnerability also maps to ATT&CK technique T1059.007 for execution through dynamic code loading and potentially T1499.004 for denial of service attacks against application processes. The mitigation strategy involves updating to torchvision version 0.28.0 or later where the commit 4e05dc2 implements proper length clamping and validation checks within the GIF decoder callback functions. Organizations should also implement input sanitization measures and consider deploying additional monitoring around image processing components to detect potential exploitation attempts.
This vulnerability highlights the importance of rigorous memory safety practices in multimedia processing libraries and demonstrates how seemingly benign image format parsing can become a vector for serious security issues. The fix implemented addresses the root cause by ensuring that all length parameters are properly validated before memory operations occur, preventing both the immediate denial of service conditions and the potential information disclosure risks associated with heap memory exposure during out-of-bounds reads.