torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl: 1 vulnerabilities (highest severity is: 7.1)

[mend-bolt-for-github]

Vulnerable Library - torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

image and video datasets and models for torch deep learning

Library home page: https://files.pythonhosted.org/packages/5d/06/09b6a917b3759ef000428af0aa2597f983e20d9fbbcfeb826750f778fe6d/torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

Path to dependency file: /ai/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260331025725_MIUFBE/python_UVEQHS/20260331025831/11/torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (torchvision version)	Remediation Possible**
CVE-2026-65918	High	7.1	torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-65918

Vulnerable Library - torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

image and video datasets and models for torch deep learning

Library home page: https://files.pythonhosted.org/packages/5d/06/09b6a917b3759ef000428af0aa2597f983e20d9fbbcfeb826750f778fe6d/torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

Path to dependency file: /ai/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260331025725_MIUFBE/python_UVEQHS/20260331025831/11/torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl

Dependency Hierarchy:

• ❌ torchvision-0.23.0-cp39-cp39-manylinux_2_28_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

Publish Date: 2026-07-23

URL: CVE-2026-65918

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here