Executive brief
torchvision is a popular library used by developers and researchers for computer vision tasks in AI applications. A flaw in how it processes GIF images allows an attacker to provide a specially crafted or truncated image file that causes the application to crash or potentially leak sensitive information from the computer's memory. This could lead to service outages or the exposure of data handled by the AI system.
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in the torchvision GIF decoder's 'read_from_tensor' callback. The root cause is a failure to use a clamped length value during a 'memcpy' operation; while the code calculates a safe 'num_bytes_to_read' based on the remaining buffer size, it incorrectly passes the original, potentially larger 'len' value to 'memcpy'. An attacker can exploit this by providing a malicious or truncated GIF file that declares a sub-block size larger than the remaining data in the input tensor. This results in a read past the end of the input buffer, which can cause a segmentation fault (DoS) or disclose adjacent heap memory. The vulnerability is reachable via 'torchvision.io.decode_gif', 'decode_image', or 'read_image'. A fix is available in commit 4e05dc2.
Affected products
- PyTorch torchvision <= 0.28.0
Timeline
- 2026-06-10: disclosed: Initial report to PyTorch security team
- 2026-06-22: patched: Fix merged into main branch via commit 4e05dc2
- 2026-07-23: advisory: Public disclosure and CVE assignment