8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1260

CVE-2026-1260: Invalid Memory Access in Sentencepiece,

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1260

CVE-2026-1260:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sentencepiece	pip	< 0.2.1	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit d856b67fdb3492e035489abf9b3aaf486144b2c0 clearly indicates a vulnerability within the PrefixMatcher constructor located in src/normalizer.cc. The commit message explicitly states it is fixing a "potential heap overflow issue". The code change itself shows that the trie_->build method was previously called without providing the lengths of the input keys (nullptr was passed). This is a classic heap overflow pattern, where the called function might read beyond the allocated buffer for the keys if the input data (from a model file, as mentioned in the vulnerability description) is not what's expected (e.g., not null-terminated). The fix involves creating a lengths vector to store the size of each key and passing it to the build function, thus preventing the out-of-bounds read. Therefore, the sentencepiece::normalizer::PrefixMatcher::PrefixMatcher function is the vulnerable function that would be observed in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

sentencepiece::normalizer::PrefixMatcher::PrefixMatcher

src/normalizer.cc

The vulnerability is in the constructor of the `PrefixMatcher` class. The original code called the `trie_->build` method with a `nullptr` for the lengths of the keys. This could cause the `build` function to read past the end of the buffer when processing a specially crafted model file, leading to a heap overflow. The patch addresses this by explicitly calculating and passing the lengths of the keys.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.