PT-2026-4204 · Unknown · Sentencepiece

Published 2026-01-22 · Updated 2026-01-23 · CVE-2026-1260

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sentencepiece versions prior to 0.2.1

Description An invalid memory access issue exists in Sentencepiece when processing a specially crafted model file that was not generated through standard training procedures. This can lead to a crash or potentially allow for arbitrary code execution.

Recommendations Update to version 0.2.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-1260

GHSA-38VQ-G6VR-W8WF

Affected Products

Sentencepiece

References · 9

• https://osv.dev/vulnerability/GHSA-38vq-g6vr-w8wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1260 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1260 · Vendor Advisory
• https://github.com/google/sentencepiece/commit/d856b67fdb3492e035489abf9b3aaf486144b2c0 · Note
• https://github.com/google/sentencepiece · Note
• https://github.com/google/sentencepiece/releases/tag/v0.2.1 · Note
• https://twitter.com/CVEnew/status/2014391568741048443 · Twitter Post
• https://twitter.com/_cvereports/status/2014521037614965037 · Twitter Post
• https://twitter.com/vuldb/status/2014697650659139868 · Twitter Post