CVE-2026-65918: PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GI
Summary
PyTorch torchvision (a library for computer vision tasks) versions up to 0.28.0 contain an out-of-bounds heap read vulnerability (a bug where software reads memory it shouldn't access) in the GIF image decoder. Attackers can send malicious or broken GIF files to crash programs using this library or steal data from nearby memory.
Solution / Mitigation
Fixed in commit 4e05dc2. Users should update to a version of PyTorch torchvision that includes this commit (after version 0.28.0).
Vulnerability Details
7.1(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
network
low
none
required
July 23, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-24747: PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-65918
First tracked: July 23, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 95%