CVE-2026-85670 tokenizers BpeBuilder Buffer Overflow via merge token
Attackers can cause denial of service or potential code execution by supplying a crafted tokenizer.json file to the Hugging Face tokenizers library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-85670?
CVE-2026-85670 is a high-severity memory corruption vulnerability in huggingface tokenizers, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::from_file/from_str, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule into it. A merge whose concatenated token exceeds the longest vocabulary key overruns the buffer, which Rust turns into a panic that aborts the process in Rust and FFI embeddings. This occurs at load time with no encoding required, so an attacker who supplies a crafted tokenizer.json can cause a denial of service. A secondary defect at the same location can cause a usize underflow (panic in debug, potential memory corruption in release) when continuing_subword_prefix is set and a merge token is shorter than the prefix. Observed in version 0.23.1.
Weakness: CWE-787
Which versions are affected by CVE-2026-85670?
How do I fix CVE-2026-85670?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-85670 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85670 exists.
Sources
Also known as GHSA-jrf5-f6jp-7vxc, RHLW-2026-b11abda52745af4c.