Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pytorch/audio

              main @ c0cbdb9
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

torchaudio.datasets: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Improper reference counting on hardware frame contexts via av_buffer_ref causes GPU memory leaks during FFmpeg stream reading, which can lead to system-wide resource exhaustion.

Insecure Hash: The use of collision-prone MD5 hashes for dataset validation allows attackers to tamper with downloaded files without detection, requiring a upgrade to SHA256.

Insecure Download: Missing or bypassed checksum validation during remote dataset retrieval permits man-in-the-middle or host-compromise attacks to execute unchecked code or load corrupted datasets.