Product:
Sentencepiece
Summary
Invalid memory access occurs in Sentencepiece versions less than 0.2.1 when using a vulnerable model file that is not created through the normal training procedure. This vulnerability can lead to potential exploitation and compromise of system integrity. It is crucial for users to be aware of this issue to prevent unauthorized access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.5 | CVE-2026-1260 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and utilize a specially crafted model file that was not generated through the standard training process. By executing the vulnerable version of Sentencepiece with this model file, the attacker can trigger the invalid memory access, potentially leading to arbitrary code execution or system crashes.
Affected Products
- Sentencepiece versions less than 0.2.1: Vulnerable to invalid memory access when using non-standard model files.
Mitigation
To mitigate this vulnerability, users should upgrade to Sentencepiece version 0.2.1 or later. This update addresses the invalid memory access issue and ensures that only properly trained model files are used. Regularly checking for updates and applying them promptly is essential for maintaining system security.