PyTorch torchvision CVE-2026-65918

Exploitation requires the target application to decode an attacker-supplied GIF through torchvision's native GIF decoder (decode_gif/decode_image) on a vulnerable build (through 0.28.0) - this is the UI:P condition: an operator or automated pipeline must ingest and decode the malicious/truncated GIF. The concrete trigger is a GIF whose byte stream ends early or is crafted so giflib requests more bytes than remain in the input tensor, causing read_from_tensor's memcpy to over-read. Limiting factors: it only fires on the GIF code path (not other formats), the app must actually accept untrusted GIF input, no authentication or privileges are needed on the attacker side, and the primary outcome is a crash or bounded heap-memory disclosure rather than code execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, base 7.1) reflects a network-reachable, low-complexity, no-privilege bug whose dominant impact is availability (VA:H, crash) with limited confidentiality (VC:L, heap disclosure) and no integrity impact - consistent with an OOB read. The one real gate is UI:P (passive user interaction): the target application must actually decode an attacker-controlled GIF, so this is not a fully autonomous remote exploit against a listening service unless such a service ingests untrusted GIFs. Publicly available exploit/reproducer code raises practical risk, but this is distinct from active exploitation - there is no KEV listing and no EPSS score was provided, so widespread mass exploitation cannot be inferred. Net: a genuine, easily-triggered DoS with a secondary info-leak in a very widely used ML library; prioritize where torchvision decodes untrusted images, but treat it as crash/leak severity rather than remote code execution.

An attacker uploads a crafted or deliberately truncated GIF to an image-processing service (for example an ML pipeline that thumbnails or preprocesses user-submitted images with torchvision). When the service calls decode_gif, giflib requests more bytes than the tensor holds and the unclamped memcpy reads past the buffer, crashing the worker (DoS) or returning bytes of adjacent heap memory. A public reproducer/exploit already exists, and the low attack complexity means reliable triggering requires only that the victim application decode the attacker's file.