CVE-2026-1260
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-30
Assigner: Google Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sentencepiece | to 0.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an invalid memory access issue in SentencePiece versions prior to 0.2.1. It occurs when using a specially crafted model file that is not created through the normal training procedure, potentially leading to a heap overflow. [1]
How can this vulnerability impact me? :
The vulnerability can lead to a heap overflow, which may cause crashes or potentially allow an attacker to execute arbitrary code or disrupt the normal operation of the SentencePiece software when processing a malicious model file. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to invalid memory access in Sentencepiece versions less than 0.2.1 when using a specially crafted vulnerable model file. Detection involves verifying the installed Sentencepiece version and checking if any model files in use are not created by the normal training procedure (i.e., potentially malicious or malformed). To detect the vulnerability on your system, you can run commands to check the installed Sentencepiece version, for example: `sentencepiece --version` or `pip show sentencepiece` if installed via Python pip. Additionally, review the model files used by Sentencepiece to ensure they are from trusted sources and created by normal training procedures. There are no specific commands provided to detect the malformed model files or the invalid memory access directly. [1]
What immediate steps should I take to mitigate this vulnerability?
Upgrade SentencePiece to version 0.2.1 or later, which includes a security fix addressing the heap overflow vulnerability caused by invalid precompiled normalization models. Additionally, consider building with the new build mode flag `-DSPM_DISABLE_EMBEDDED_DATA=ON` to prevent embedding precompiled normalization rules directly into binaries, reducing risk. [1]