CVE-2026-1260

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1260
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1260.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1260
Aliases
Published
2026-01-22T17:16:30.643Z
Modified
2026-02-01T05:52:22.438431Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

References

Affected packages

Git / github.com/google/sentencepiece

Affected ranges

Type
GIT
Repo
https://github.com/google/sentencepiece
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
31646a467d2051eb904e0b45de3a73e91fe1c1e3

Affected versions

0.*
0.2.1pre1
v0.*
v0.1.4
v0.1.5
v0.1.6
v0.1.6pre1
v0.1.7
v0.1.8
v0.1.81
v0.1.82
v0.1.83
v0.1.84
v0.1.85
v0.1.86
v0.1.9
v0.1.90
v0.1.91
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.98pre1
v0.1.99
v0.1.99pre1
v0.2.0
v0.2.0pre1
v0.2.1pre1
v0.2.1pre2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1260.json"