CVE-2026-85670
Received Received - Intake

Out-of-Bounds Buffer Access in Hugging Face Tokenizers

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::from_file/from_str, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule into it. A merge whose concatenated token exceeds the longest vocabulary key overruns the buffer, which Rust turns into a panic that aborts the process in Rust and FFI embeddings. This occurs at load time with no encoding required, so an attacker who supplies a crafted tokenizer.json can cause a denial of service. A secondary defect at the same location can cause a usize underflow (panic in debug, potential memory corruption in release) when continuing_subword_prefix is set and a merge token is shorter than the prefix. Observed in version 0.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85670
EUVD
EUVD-2026-71126

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hugging_face tokenizers to 0.23.2 (inc)
hugging_face tokenizers 0.23.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds buffer access in the Hugging Face tokenizers library. When loading a tokenizer.json file, the BpeBuilder::build function allocates a scratch buffer sized to the longest vocabulary key. If a merge rule's concatenated token exceeds this length, it causes a buffer overflow, leading to a Rust panic that aborts the process. A secondary issue involves a usize underflow when continuing_subword_prefix is set and a merge token is shorter than the prefix.

Detection Guidance

Detecting this vulnerability requires checking for crashes or panics when loading tokenizer.json files in applications using Hugging Face tokenizers. Monitor logs for Rust panic messages or process aborts during tokenizer initialization. Inspect tokenizer.json files for unusually long merge rules or tokens exceeding expected lengths.

Impact Analysis

An attacker can supply a crafted tokenizer.json file to cause a denial of service by crashing the application. This occurs during load time without requiring any encoding. Systems loading untrusted tokenizer files, such as model hubs or inference servers, are at risk of process termination.

Compliance Impact

This vulnerability primarily causes denial of service by crashing processes when loading malicious tokenizer files. For compliance standards like GDPR or HIPAA, which require data availability and integrity, such disruptions could lead to violations if systems fail to process or store data correctly. The buffer overflow may also risk unauthorized access if memory corruption occurs, potentially exposing sensitive data.

Mitigation Strategies
  • Upgrade to the latest version of Hugging Face tokenizers library where the vulnerability is patched.
  • Avoid loading untrusted tokenizer.json files from untrusted sources.
  • Implement input validation to check the length of merge rules and tokens before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart