CVE-2026-65918 describes an out-of-bounds heap read vulnerability in PyTorch's torchvision library through version 0.28.0. The vulnerability occurs in the GIF decoder's read_from_tensor callback function, where an unclamped length parameter is passed to memcpy, allowing attackers to cause memory corruption by supplying crafted or truncated GIF files. This can result in a denial of service due to segmentation faults or unintended disclosure of adjacent heap memory. The issue was resolved in a specific commit (4e05dc2). No official remediation level or patch link is provided in the data.

Successful exploitation can cause a denial of service by crashing the application via segmentation faults or can lead to disclosure of adjacent heap memory contents, potentially exposing sensitive information. The vulnerability is remotely exploitable without privileges or user interaction beyond supplying a crafted GIF file. The CVSS 4.0 score of 7.1 reflects a high severity impact with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 4e05dc2; users should apply this fix or upgrade to a version that includes it. Until then, avoid processing untrusted GIF files with affected versions of torchvision.