CVE-2026-65918

Katalog CVE

CVSS 7.1 · High EPSS 0,45%

Kerentanan Out-of-bounds Read pada linuxfoundation torchvision. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

Rincian

Terbit di NVD

23 Juli 2026

Terakhir diubah

17 September 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed patch
• https://github.com/pytorch/vision/pull/9520 issue tracking · patch
• https://www.vulncheck.com/advisories/pytorch-torchvision-gif-decoder-out-of-bounds-heap-read exploit · patch · advisory pihak ketiga
• https://github.com/pytorch/vision/issues/9551 exploit · issue tracking