EUVD-2026-48341
GHSA-xhgh-4jhq-chj3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered file that a user/app must decode (UI:R), no auth (PR:N), low complexity; impact is high availability (crash) plus limited confidentiality (heap read), no integrity.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.
AnalysisAI
Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.
Technical ContextAI
torchvision ships C++ image decoders (torchvision/csrc/io/image/cpu/decode_gif.cpp) that wrap the giflib GIF-parsing engine. giflib pulls encoded bytes through a caller-supplied read callback; here read_from_tensor copies from the user tensor buffer into giflib's working buffer. The vulnerability is CWE-125 (Out-of-bounds Read): read_from_tensor called memcpy(buf, encoded_data + num_bytes_read, len) using giflib's requested len rather than the number of bytes actually remaining in the tensor, so a truncated/crafted GIF makes giflib request more bytes than exist and memcpy reads past the end of the tensor's heap allocation. The CPE cpe:2.3:a:pytorch:vision:*:*:*:*:*:*:*:* confirms the affected product is the pytorch 'vision' (torchvision) package. Notably, the PR diff also fixes a second, related canvas-clipping issue (an out-of-bounds heap WRITE when a frame's Image Descriptor Top/Left offset places pixels outside the allocated output tensor); the CVE text describes only the read, so the write-side issue may be under-documented in the advisory.
RemediationAI
Upstream fix available (PR/commit); a released patched version was not independently confirmed from the input - the fix is commit 4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed (PR #9520), which clamps the memcpy length to the bytes remaining in the tensor and clips out-of-canvas frame pixels. Upgrade to the first torchvision release that includes this commit (verify the exact tag against the PyTorch release notes rather than assuming a version number), or apply the commit as a backport if you build torchvision from source. Until patched, the practical compensating control is to stop feeding untrusted GIF data to torchvision's decoder: validate/reject GIF inputs before decode, or route untrusted images through a hardened external decoder (e.g. Pillow) instead of torchvision.decode_gif/decode_image, and run any decoding of untrusted media in a sandboxed/isolated worker so a segmentation fault or heap read cannot affect the main process. Trade-off: switching decoders or adding input validation changes your image-loading path and must be re-tested for format coverage and performance. Reference advisories: https://www.vulncheck.com/advisories/pytorch-torchvision-gif-decoder-out-of-bounds-heap-read and https://github.com/pytorch/vision/pull/9520.
TorchServe is a tool for serving and scaling PyTorch models in production. Rated critical severity (CVSS 9.8), this vuln
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. Rated critical severity (CVSS 9.8), this vulnerability is
PickleScan before 0.0.23 can be bypassed by flipping specific ZIP file header flag bits, allowing malicious pickle files
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sendi
picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to e
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. Rated critical sever
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built
NVIDIA APEX for Linux contains a deserialization of untrusted data vulnerability that affects environments using PyTorch
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Rated medium severity (CVSS
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0.cuda.memory.caching_allocator_dele
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today