Black Hat Asia 2026 | Model Files → Memory Corruption → RCE: The Triple-Stage AI Attack Chain
Source: YouTube · Black Hat · published Aug 30, 2026 · 36:40
BLUF: Researchers demonstrate how to bypass PyTorch’s weights_only=True safety mechanism by exploiting a memory corruption vulnerability in TorchScript to achieve Remote Code Execution (RCE) 0:30, highlighting the risks of loading untrusted AI models in applications like OpenSearch 24:50.
Key Takeaways:
• PyTorch’s weights_only=True mode was previously considered secure, but it internally uses torch.jit.load for TorchScript files, which supports high-risk operators like file writing and reading, creating a logical vulnerability 6:15.
• A heap underflow vulnerability exists in the torch.store_as_stride operator due to an integer overflow when calculating storage offsets with large values, allowing out-of-bounds read/write access 15:40.
• Exploiting this bug allows attackers to leak heap addresses and libc pointers, eventually leading to arbitrary code execution by overwriting function pointers or destructors 21:30.
• In the OpenSearch application, while direct RCE via execve was blocked by a syscall blacklist, the vulnerability enabled arbitrary file reads (leaking credentials) and file writes, demonstrating significant security impact 31:00.
• The OpenSearch team classified this as a configuration risk rather than a product vulnerability, noting that the feature allowing model registration via URL is disabled by default and requires admin privileges to enable 33:15.
The evolution of AI security is shifting from simple deserialization attacks to complex memory corruption issues in high-performance C++ backends. Developers must strictly control model sources and enforce robust permission boundaries in AI-enabled applications to mitigate these risks.
Sources:
- 0:30 Introduction to the triple-stage AI attack chain and memory corruption to RCE.
- 6:15 Explanation of how
weights_only=Truetriggerstorch.jit.load, exposing logical vulnerabilities. - 15:40 Demonstration of the heap underflow vulnerability in
torch.store_as_stride. - 21:30 Description of the exploit primitive for arbitrary memory read/write.
- 24:50 Investigation of OpenSearch as a target for TorchScript exploitation.
- 31:00 Demonstration of file read/write capabilities within OpenSearch despite syscall restrictions.
- 33:15 OpenSearch’s response to the vulnerability report and security stance.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. I'm Lulay. Today Georgian and I will be presenting model files to memory corruption to RCE recognizing the triple stage AI attack chain. First, let me briefly introduce ourselves. We are both independent security researchers focusing on Java, cloud, and assistant security. Next, here's today's agenda. We'll begin with an introduction to AI models followed by a quick review of historical vulnerabilities in model loading process. Then we will detail a memory vulnerability in model files and show how we exploit it to achieve RCE. After that, we will demonstrate how these vulnerabilities can be used to attack AI applications. Finally, we will conclude with mitigations and a summary. So, first let's quickly introduce the AI models. With the surge in AI, more and more wrestling m…