Hi,

The following vulnerability was published for pytorch-vision.

CVE-2026-65918[0]:
| PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2,
| contains an out-of-bounds heap read vulnerability in the GIF
| decoder's read_from_tensor callback that passes unclamped length to
| memcpy. Attackers can supply malicious or truncated GIF files to
| cause denial of service via segmentation fault or disclose adjacent
| heap memory contents.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-65918
https://www.cve.org/CVERecord?id=CVE-2026-65918
[1] https://github.com/pytorch/vision/issues/9551
[2] https://github.com/pytorch/vision/pull/9520
[3] https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
pytorch-vision, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142689@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dylan Aïssi <daissi@debian.org> (supplier of updated pytorch-vision package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 12:16:35 +0200
Source: pytorch-vision
Architecture: source
Version: 0.29.1-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Deep Learning Team <debian-ai@lists.debian.org>
Changed-By: Dylan Aïssi <daissi@debian.org>
Closes: 1142689
Changes:
 pytorch-vision (0.29.1-1~exp1) experimental; urgency=medium
 .
   [ Dylan Aïssi ]
   * New upstream version 0.29.1
     - Fix CVE-2026-65918 (Closes: #1142689)
   * Build-Depends: bump minimal pytorch version to 2.14.1~
 .
   [ Mario Limonciello (AMD) ]
   * d/control: sync architectures with pytorch
Checksums-Sha1:
 0ef6b88500c909ac3e1633bec0dceac525859be3 2443 pytorch-vision_0.29.1-1~exp1.dsc
 a0b9b253184334715df1e48368033d9810baee3b 14444371 pytorch-vision_0.29.1.orig.tar.gz
 3470b93e43af6bb5bcbc5e2d82088e6c0dc99718 5524 pytorch-vision_0.29.1-1~exp1.debian.tar.xz
 aeeee7268b749cedc053375d32b65947e9b60174 15695 pytorch-vision_0.29.1-1~exp1_amd64.buildinfo
Checksums-Sha256:
 54bb8648d73e5b9ad9184a6bcd875fb12b1c6113e3292c6a9961b00a854d4184 2443 pytorch-vision_0.29.1-1~exp1.dsc
 0a14655bd32095148d93fa595f93aba45dda0d13b25cc7fe86a041340e4a4862 14444371 pytorch-vision_0.29.1.orig.tar.gz
 6690db84c921e36354f722351f83254188b6f836c94b56e4e495080c15cf7b18 5524 pytorch-vision_0.29.1-1~exp1.debian.tar.xz
 c2278a7fb07156b5b3aa281a208ef686390278b63fd313871c1f9ad9f6cf52a9 15695 pytorch-vision_0.29.1-1~exp1_amd64.buildinfo
Files:
 b32d9260b20210165ed6c71ce8d742f8 2443 science optional pytorch-vision_0.29.1-1~exp1.dsc
 5659085e4dc2161680540f804d3826bc 14444371 science optional pytorch-vision_0.29.1.orig.tar.gz
 3661f0cfcda0fcd0f9444673d92ef5e4 5524 science optional pytorch-vision_0.29.1-1~exp1.debian.tar.xz
 fa73569b11d90f58d5b820e2bda82012 15695 science optional pytorch-vision_0.29.1-1~exp1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmjwHvQbeL0FugTpdYS7xYT4FD1QFAmrXQtMACgkQYS7xYT4F
D1RYzA/+OroixynMKla3PjsVbH0LlE6qczYAqKt9hRtvmWCifUpFdVej9EBKD2z6
vXrxLvC4/fnjFQXflI3MblP5EoZILL5Ajv3gKDyytB7LDWh3sDZhJSYYcS02AXn9
6W0U0k7o2/5fTh6cWm94Hk8bnwX+t8M/yPcb71atXoCbdUjNhtweO4puxOFXFayS
0KoWptWzGfMFG43KosleX0q9BpfkXLCRbhU75HswesAwNYsBVUR086jdm21oc0E6
sRhHr5pc5k31z8yv4u0c76j+KctWknTPqELf9jpg39hp5LLZgO/0W/DaMZ+2aNBR
VFta8ncBN3YYm2YRZBIzh7PXdflZge2gb4wIkF+D/9iCyQ102+TuSA/VwmQqaDpq
MznmlE998LKA5hw67pfD5vQZeUkUQvg+o4E2B1kDiXJfi7jYgYAd41dgmPwNcijl
xLQ1/TJ8srTyPdqYs5dkQ8QDWKNE3BXGFREiL4AnclcYCKwEkhY2UiI7UabyJ9Ik
LWyoZZ+bRsrNp43UZvUvdoxBgsVnXA0XLNPDFDHcHqxaenTvuj6ux+tWs2Ng4DkU
lWgUTyNPSTAfQYpW1GjXdbM6IBV00fwHCg9l07I0xNwcLJPrpLNEpiGhN3pqKXhS
4z0Nm7+E+AeAHp8HaaIhqGuUaY1LuZfmmuXMfSQ5bfk4J9oVavE=
=EheD
-----END PGP SIGNATURE-----