GitHub Advisoryadvisory · PyPI

GHSA-38vq-g6vr-w8wf Sentencepiece has a a heap overflow issue

HIGH Published 2026-01-22 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-1260
Ecosystem
PyPI
Packages
sentencepiece
Severity
High
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-119
Reviewed
2026-01-22

Affected packages

• PyPI sentencepiece: < 0.2.1 → fixed in 0.2.1

Description

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

Related

Alias · CVE (1)

  • CVE-2026-1260 Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References