PyTorch torch.jit.script memory corruption with list attributes
PyTorch's torch.jit.script compiler crashed with a segmentation fault when compiling classes that contained untyped list attributes. The defect was fixed by implementing validation to reject bare list and tuple annotations.
What happened
Using @torch.jit.script decorator to compile a class with a list attribute in the __init__ method caused a segmentation fault at runtime in PyTorch version 2.6.0.
The crash occurred when torch.jit.script attempted to compile a scripted class containing a dynamic Python list structure without proper type annotation.
Reported impact
Applications using torch.jit.script with untyped list attributes would crash with a segmentation fault rather than raising a runtime error, causing loss of service.
Index analysis
The defect was in the torch.jit.script compiler's handling of bare list and tuple annotations in class attributes.
PyTorch addressed the issue by implementing validation to reject bare `list`/`tuple` value annotations in JIT-compiled code.
Governance controls
PyTorch assigned CVE-2025-3000 to track the vulnerability and closed the issue as completed on July 2, 2026 after merging a fix that rejects bare list and tuple type annotations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.