CVE-2026-65918: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-65918 is an out-of-bounds heap read vulnerability in PyTorch torchvision's GIF decoder that allows attackers to cause denial of service or disclose adjacent heap memory contents by supplying malicious or truncated GIF files. It affects torchvision versions through 0.28.0 and was fixed in commit 4e05dc2 (merged June 22, 2026). The vulnerability was originally reported via a private security advisory on June 10, 2026, and publicly disclosed on July 23, 2026. It carries a CVSS v3.1 score of 7.1 (High) and a CVSS v4.0 score of 7.1 (High) (Github Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in torchvision/csrc/io/image/cpu/decode_gif.cpp within the read_from_tensor callback. The function correctly computes a clamped value num_bytes_to_read = std::min((size_t)len, remaining) but then passes the original unclamped len to std::memcpy, causing it to read len - remaining bytes past the end of the input tensor's backing buffer. Exploitation requires a user or application to decode a crafted or truncated GIF file, which can be triggered via torchvision.io.decode_gif(), decode_image(), or read_image() — the latter two auto-dispatch to the GIF decoder on detection of GIF magic bytes. A secondary out-of-bounds write issue in the per-frame raster loop (using frame Top/Left offsets without canvas bounds checking) was also identified and fixed in the same commit (GitHub Issue, Fix PR, Fix Commit).

Successful exploitation can result in two distinct outcomes: a segmentation fault (SIGSEGV) causing denial of service by crashing the process, or disclosure of adjacent heap memory contents that may contain sensitive data such as model weights, intermediate tensors, or other in-memory application data. The vulnerability is particularly relevant in ML inference pipelines or web services that accept user-supplied images for processing, where an unauthenticated attacker could submit a malicious GIF to trigger the bug. Integrity is not directly impacted, and there is no evidence of lateral movement potential beyond the affected process (Github Advisory, Feedly).

1. Craft a malicious GIF: Create a GIF file where a sub-block declares a len value larger than the remaining bytes in the file (e.g., a truncated GIF or one with an inflated sub-block size field). This is trivially achievable by hand-crafting GIF binary data or truncating a valid GIF.
2. Deliver the GIF to the target: Supply the malicious GIF to any application or service that uses torchvision to decode images — via file upload, API endpoint, dataset ingestion pipeline, or any other input vector that passes user-controlled data to torchvision.io.decode_image(), decode_gif(), or read_image().
3. Trigger GIF decoding: The application calls one of the affected torchvision image decoding functions. decode_image() and read_image() auto-dispatch to the GIF decoder upon detecting GIF magic bytes (GIF87a or GIF89a).
4. Trigger the out-of-bounds read: Inside read_from_tensor, giflib requests len bytes; the clamped num_bytes_to_read is computed correctly but memcpy uses the unclamped len, reading past the end of the input buffer into adjacent heap memory.
5. Achieve objective: Depending on heap layout, the result is either a SIGSEGV (denial of service) or silent disclosure of adjacent heap contents, which may be observable via error messages, logs, or a controlled response channel if the application reflects decoded data (GitHub Issue, Fix Commit).

• Process: Application process (Python/torchvision) crashes with SIGSEGV or segmentation fault signal when processing a GIF file; unexpected process termination in ML inference services.
• Logs: Application error logs showing Segmentation fault (core dumped) or giflib-related errors during image decoding; crash reports referencing decode_gif.cpp or read_from_tensor.
• File System: Presence of crafted or anomalous GIF files in upload directories or dataset staging areas with sub-block size fields exceeding actual file size; core dump files generated by the torchvision process.
• Network: Repeated submission of small or malformed GIF files (identifiable by GIF magic bytes 47 49 46 38 followed by truncated content) to image processing endpoints, particularly from a single source IP (GitHub Issue).

The fix is available in commit 4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed, merged into pytorch/vision:main on June 22, 2026, and cherry-picked for the 0.28 branch in PR #9521. Users should upgrade torchvision to any version built from a commit after 4e05dc2. As a workaround prior to upgrading, applications should validate GIF files before passing them to torchvision (e.g., reject files where declared sub-block sizes exceed file length), restrict GIF decoding functionality if not required, and apply strict access controls to limit which users or processes can submit images for decoding (Fix PR, Fix Commit).

The vulnerability was originally reported privately via GitHub's security advisory system on June 10, 2026, but received no response, prompting the researcher (geo-chen) to file a public issue (#9551) on July 13, 2026. The torchvision maintainer NicolasHug had already merged a fix (PR #9520) on June 22, 2026 — prior to the public issue — describing it as a "bug on malformed gif where we would potentially try to write outside of the allocated tensor's memory." VulnCheck assigned the CVE and published an advisory. No broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator coverage (GitHub Issue, Fix PR).