CVE-2026-1260CWE-119

Invalid Memory Access in Sentencepiece,

High · published January 22, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

⚡ Invalid memory access in Sentencepiece versions before 0.2.1 can lead to serious issues—it's like a miswritten recipe causing a kitchen disaster! 🔥 Think of it like cooking without a proper recipe: you might end up with something inedible or even dangerous. This vulnerability allows an attacker to manipulate a model file, leading to unpredictable behavior, much like using expired ingredients could spoil the whole meal! An attacker could exploit this vulnerability to cause crashes or unexpected behavior in applications, potentially leading to data corruption or even system compromise. With such high stakes, a faulty model file might turn a helpful AI tool into a ticking time bomb!

Put simply

Think of it like cooking without a proper recipe: you might end up with something inedible or even dangerous. This vulnerability allows an attacker to manipulate a model file, leading to unpredictable behavior, much like using expired ingredients could spoil the whole meal! This high-severity vulnerability arises from invalid memory access in Sentencepiece when using a model file not created through standard training procedures. This flaw permits attackers to manipulate memory, potentially leading to crashes or arbitrary code execution.

What to do

An attacker could exploit this vulnerability to cause crashes or unexpected behavior in applications, potentially leading to data corruption or even system compromise. With such high stakes, a faulty model file might turn a helpful AI tool into a ticking time bomb! To mitigate this risk, upgrade Sentencepiece to version 0.2.1 or later. Additionally, ensure that all model files are created following the correct training procedure to avoid introducing vulnerabilities. It's also wise to regularly audit and test your AI components! You've got this! By following these steps, you'll secure your applications and keep them running smoothly! 🛡️

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00176 · 6.7th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2026-01-22T17:06Z
EPSS history
Timeline
  • 22 JAN 17:06Z
    Invalid Memory Access in Sentencepiece,
    cvelistv5